# CVE-2026-14982: WP File Download arbitrary file deletion via insufficient path validation

Source: https://junglewise.ai/threats/cve-2026-14982-wp-file-download-arbitrary-file-deletion-via-insufficient-path  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-14982 · Severity: high · CVSS 8.1 · Published 2026-09-02

WP File Download is a WordPress plugin that manages file downloads and access on websites. Authenticated attackers with subscriber-level access can delete arbitrary files from the server, including critical WordPress configuration files, leading to website compromise or remote code execution.

Technologies: [JoomUnited WP File Download](https://junglewise.ai/threats/technologies/wp-file-download). Vendors: [JoomUnited](https://junglewise.ai/threats/vendors/joomunited).

## Quick answers

**Is CVE-2026-14982 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14982 being exploited in the wild.

**How severe is CVE-2026-14982?** High severity, with a CVSS score of 8.1, published 2 September 2026.

**Which products and versions are affected?** JoomUnited WP File Download all versions.

**Is there a fix for CVE-2026-14982?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-14982 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-14982?** Check whether you run JoomUnited WP File Download at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability stems from insufficient file path validation in the delete function, allowing path traversal attacks. The exploit operates in two stages: first, an attacker calls the file.save task to persist a path-traversal string into file metadata (lacking capability checks and nonce enforcement), then calls the file.delete task to trigger the unlink function on the traversed path. Any authenticated user with subscriber-level privileges or above can execute this attack. Successful deletion of sensitive files like wp-config.php can result in remote code execution or complete site compromise.

## Affected products

- JoomUnited WP File Download all versions

## Timeline

- 2026-09-02: disclosed

## References

- [https://www.joomunited.com/changelog/wp-file-download-changelog](https://www.joomunited.com/changelog/wp-file-download-changelog)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/e0ae30a4-dbd6-4c1f-8786-786b46d64a65?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/e0ae30a4-dbd6-4c1f-8786-786b46d64a65?source=cve)

## Related threats

- [WP File Download authorization bypass](https://junglewise.ai/threats/cve-2026-94538-the-wp-file-download-plugin-for-wordpress-is-vulnerable-to)
- [WP File Download directory traversal in remoteurl parameter](https://junglewise.ai/threats/cve-2026-14975-wp-file-download-directory-traversal-in-remoteurl-parameter)