Executive brief
WP File Download is a WordPress plugin that manages file downloads and access on websites. Authenticated attackers with subscriber-level access can delete arbitrary files from the server, including critical WordPress configuration files, leading to website compromise or remote code execution.
Technical details
The vulnerability stems from insufficient file path validation in the delete function, allowing path traversal attacks. The exploit operates in two stages: first, an attacker calls the file.save task to persist a path-traversal string into file metadata (lacking capability checks and nonce enforcement), then calls the file.delete task to trigger the unlink function on the traversed path. Any authenticated user with subscriber-level privileges or above can execute this attack. Successful deletion of sensitive files like wp-config.php can result in remote code execution or complete site compromise.
Affected products
- JoomUnited WP File Download all versions
Timeline
- 2026-09-02: disclosed