WP File Download CVE-2026-14982

Requires a valid WordPress user account at subscriber level or above - the lowest role assigned by default to registered users on any WordPress site with membership enabled. Both the file.save and file.delete AJAX endpoints lack WordPress nonce verification and capability checks, so no elevated role, plugin-specific permission, or special configuration is needed beyond a valid authenticated session cookie. The exploit is a two-stage HTTP sequence: the first request to file.save persists the attacker-controlled path-traversal string into file metadata, and the second request to file.delete triggers the unlink() call against that stored path - no race condition or timing dependency exists between the two stages. No non-default plugin configuration or feature flag is required; the vulnerable code paths are active whenever the plugin is installed and active. Exploitation is limited to authenticated sessions; sites that disable new user registration or remove subscriber-role assignment from the default flow meaningfully reduce external attacker access. The unlink() call is bounded by the filesystem permissions of the web server process, so files owned by root and not writable by www-data cannot be deleted.

The CVSS 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) accurately characterizes the low-friction exploitation path, but the scored I:H/A:H understates real-world blast radius: deletion of wp-config.php forces WordPress into setup mode and allows the attacker to redirect the database connection, effectively achieving unauthenticated remote code execution post-deletion - pushing the practical severity toward critical. The subscriber-level prerequisite (PR:L) is a meaningful but thin barrier; any WordPress installation with open user registration trivially hands an attacker the required credential, and even a mid-sized municipal IT team in olsztyn operating a public-facing WordPress site should treat this as urgent given the minimal access threshold. No CISA KEV listing exists and no public exploit code has been confirmed, which moderates immediate mass-exploitation risk, but the Wordfence advisory's detailed description of the two-step mechanism substantially lowers the time-to-exploit for motivated actors. The absence of nonce and capability enforcement on both endpoints is particularly damaging because it bypasses the compensating controls that WordPress administrators typically rely on.

An attacker self-registers a free subscriber account on a public WordPress site running WP File Download, then issues a crafted POST to the file.save AJAX endpoint with a path-traversal payload (e.g., ../../wp-config.php) embedded in the file metadata - the endpoint accepts it without nonce or capability validation. A subsequent POST to the file.delete AJAX endpoint triggers PHP unlink() on the stored traversal path, deleting wp-config.php; WordPress then enters database setup mode, allowing the attacker to connect a controlled database and gain full administrative code execution. No confirmed public exploit code exists, but the complete two-request sequence is described in the Wordfence advisory.