CVE-2026-3124

✦ AI Explanation

The Download Monitor plugin for WordPress has a vulnerability that allows attackers to exploit a mismatch between PayPal transaction tokens and local orders, enabling them to steal paid digital goods by paying for a low-cost item and using that payment token to finalize a high-value order. This is due to missing validation on a user-controlled key in the executePayment() function. Attackers can complete arbitrary pending orders without authentication.

How to Fix

1. 1Update the Download Monitor plugin to a version higher than 5.1.7, 2. Validate user-controlled keys in the executePayment() function to prevent Insecure Direct Object Reference, 3. Monitor for suspicious transaction activity and implement additional security measures to prevent exploitation