Download Monitor WordPress Plugin Insecure Direct Object Reference Vulnerability Allowing Unauthenticated Arbitrary Order Completion

A vulnerability allowing Insecure Direct Object Reference (IDOR) has been identified in the Download Monitor plugin for WordPress, affecting all versions through 5.1.7. The issue arises in the executePayment() function, where insufficient validation of a user-controlled key allows unauthenticated attackers to complete arbitrary pending orders. Exploitation involves manipulating the PayPal transaction token to match a local order, enabling the theft of digital goods by paying a minimal amount for a low-cost item and using that token to finalize a high-value order.

Impact

Exploitation of this vulnerability allows for unauthorized completion of orders, leading to potential theft of digital goods.

Remediation

Users are advised to update the Download Monitor plugin to version 5.1.8 or later.