title: Simple Download Monitor < 3.9.9 - Multiple CSRF
description: The Simple Download Monitor WordPress plugin before 3.9.9 does not enforce nonce checks, which could allow attackers to perform CSRF attacks to 1) make admins export logs to exploit a separate log disclosure vulnerability (fixed in 3.9.6), 2) delete logs (fixed in 3.9.9), 3) remove thumbnail image from downloads
problem types: CWE-352 Cross-Site Request Forgery (CSRF)
affected:
{
product: Simple Download Monitor
vendor: Unknown
versions:
lessThan: 3.9.9, status: affected, version: 3.9.9, versionType: custom
}