Executive brief
WP File Download is a WordPress plugin that manages file downloads and storage on websites. The plugin contains a directory traversal vulnerability that allows attackers to read arbitrary files from the server by manipulating file paths. Authenticated users with minimal permissions (Subscriber level) can poison file metadata, and unauthenticated visitors can then access sensitive files like configuration and database credentials, potentially compromising the entire website.
Technical details
The vulnerability is a directory traversal flaw in the 'remoteurl' parameter affecting WP File Download versions up to 6.3.8. An authenticated attacker with Subscriber-level access exploits an unprotected file.save handler to poison the _wpfd_file_metadata['file'] post-meta value with traversal sequences (e.g., ../../../etc/passwd). The streaming endpoint, hooked on init without authentication requirements, resolves and streams the traversed file path to any caller, including unauthenticated visitors. This allows reading of arbitrary files containing sensitive information such as wp-config.php and database credentials. The vulnerability requires initial authenticated access but can be exploited by unauthenticated users post-poisoning.
Affected products
- JoomUnited WP File Download up to and including 6.3.8
Timeline
- 2026-09-05: disclosed
- other: Patched in version 6.3.10 (as of changelog date 2026-09-25)