CVE-2026-39486
Published: 08 April 2026
Summary
CVE-2026-39486 is a high-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 7.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Databases (T1213.006); ranked at the 10.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly enforces validation and sanitization of information inputs to prevent SQL injection vulnerabilities like this blind SQLi in the Download Monitor plugin.
Mandates identification, reporting, and correction of system flaws, such as patching the SQL injection vulnerability in Download Monitor versions up to 5.1.8.
Requires regular vulnerability scanning to identify SQL injection flaws in plugins like Download Monitor before exploitation by high-privilege users.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The blind SQL injection vulnerability allows high-privileged users (e.g., WordPress admins) to extract sensitive data from the database, directly enabling collection from information repositories (specifically databases).
NVD Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Chill Download Monitor download-monitor allows Blind SQL Injection.This issue affects Download Monitor: from n/a through <= 5.1.8.
Deeper analysisAI
CVE-2026-39486 is an Improper Neutralization of Special Elements used in an SQL Command vulnerability, classified as Blind SQL Injection (CWE-89), in the WP Chill Download Monitor WordPress plugin (download-monitor). This issue affects all versions from n/a through 5.1.8, as published on 2026-04-08.
The vulnerability carries a CVSS v3.1 base score of 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L), indicating exploitation over the network with low attack complexity by high-privilege users, without requiring user interaction. Attackers with sufficient privileges, such as WordPress administrators, can perform blind SQL injection to achieve high-impact confidentiality violations, such as extracting sensitive data from the database, while causing low impacts to integrity and availability and changing the scope to affect other components.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/download-monitor/vulnerability/wordpress-download-monitor-plugin-5-1-8-sql-injection-vulnerability?_s_id=cve details the vulnerability in the WordPress Download Monitor plugin version 5.1.8.
Details
- CWE(s)