{"id":"CVE-2026-118637","title":"Simple Download Monitor < 4.1.3 - Contributor+ Private Download Item Title and Description Disclosure via [sdm_show_download_info] Shortcode","summary":"The Simple Download Monitor WordPress plugin before 4.1.3 does not properly check the visibility of the content referenced by one of its shortcodes, allowing users with a role as low as Contributor to disclose the title and description o…","severity":"low","cvss":2.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","cvssSource":"adp","cwe":["CWE-200"],"product":"Simple Download Monitor","affected":["simple_download_monitor < 4.1.3"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-04T14:01:09.381437Z"},"published":"2026-11-04","updated":"2026-11-04","sourceUpdated":"2026-11-04T14:18:19.157Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-118637","references":[{"url":"https://wpscan.com/vulnerability/bf1275d7-f48b-4f30-90f1-024604aaf848/"}],"tags":["cve.org"],"epss":0.00189,"epssPercentile":0.0856,"ingestedAt":"2026-11-05T21:36:00.357Z","slug":"CVE-2026-118637","body":"## Overview\n\nThe Simple Download Monitor WordPress plugin before 4.1.3 does not properly check the visibility of the content referenced by one of its shortcodes, allowing users with a role as low as Contributor to disclose the title and description of private, draft and other non-public posts.\n\n## Affected\n\n- `simple_download_monitor < 4.1.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":15,"depthScoreParts":{"impact":14.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}