EUVD-2026-69821
GHSA-gccv-v436-7783
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Network-accessible AJAX endpoints require only a valid subscriber session (PR:L); path-traversal-driven unlink() achieves I:H and A:H with no confidentiality exposure and unchanged scope.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete function in all versions. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The two-stage exploit requires a first request to the file.save task to persist the path-traversal string into file metadata, followed by a second request to the file.delete task to trigger the unlink call - both endpoints lack capability checks and nonce enforcement.
Articles & Coverage 1
AnalysisAI
Arbitrary file deletion in the WP File Download WordPress plugin (all versions, by JoomUnited) allows any authenticated subscriber-level user to delete files outside the plugin's intended directory, with trivial escalation to remote code execution by targeting wp-config.php. The vulnerability stems from two AJAX endpoints - file.save and file.delete - that lack both WordPress capability checks and nonce enforcement, permitting the two-stage exploit chain against any authenticated session. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid WordPress user account at subscriber level or above - the lowest role assigned by default to registered users on any WordPress site with membership enabled. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) accurately characterizes the low-friction exploitation path, but the scored I:H/A:H understates real-world blast radius: deletion of wp-config.php forces WordPress into setup mode and allows the attacker to redirect the database connection, effectively achieving unauthenticated remote code execution post-deletion - pushing the practical severity toward critical. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update WP File Download to the latest available version immediately via the JoomUnited changelog at https://www.joomunited.com/changelog/wp-file-download-changelog; an exact patched version cannot be independently confirmed from the available data, so verify directly with the vendor before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: disable and physically remove the WP File Download plugin from all WordPress instances via the admin dashboard or SSH, then verify removal via the plugin management interface. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today