# CVE-2021-24786: Download Monitor - SQLi

> Live exploitation tracking for CVE-2021-24786 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2021-24786

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 7.2
- **Public exploit available:** Yes
- **Affected products:** Download Monitor
- **Weaknesses:** CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
- **Tags:** wordpress, cms

## Description

The Download Monitor WordPress plugin before 4.4.5 does not properly validate and escape the "orderby" GET parameter before using it in a SQL statement when viewing the logs, leading to an SQL Injection issue

## CrowdSec analysis

[CVE-2021-24786](https://euvd.enisa.europa.eu/vulnerability/CVE-2021-24786) is an SQL injection vulnerability in the Download Monitor WordPress plugin prior to version 4.4.5, caused by improper validation and escaping of the "orderby" GET parameter. This flaw could allow authenticated attackers to manipulate database queries, potentially leading to unauthorized data access, data modification, or even complete compromise of the affected WordPress site.

CrowdSec has been tracking this vulnerability and its exploits since 30th of March 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2021-24786 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the `/wp-admin/edit.php` endpoint with the `post_type=dlm_download` and `page=download-monitor-logs` parameters, injecting SQL code via the `orderby` parameter to execute arbitrary SQL commands on vulnerable WordPress sites running the Download Monitor plugin.

## Timeline

- 2022-01-03: CVE Published. CVE-2021-24786 is published to NVD.
- 2026-03-30: Rule Released. CrowdSec releases a rule to detect CVE-2021-24786 exploitation attempts against the CrowdSec Network.
- 2026-07-05: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2021-24786 for the first time.

## References

- https://wpscan.com/vulnerability/a6571f16-66d2-449e-af83-1c6ddd56edfa
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24786.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2021-24786) follows observed exploitation activity for CVE-2021-24786. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.