EUVD-2026-53330
GHSA-cc9f-29gq-5x7c
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Requires administrator-level WordPress credentials (PR:H); once authenticated, upload and PHP execution are trivially simple (AC:L, UI:N), yielding full server compromise with no scope change.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
3DescriptionCVE.org
The wp-downloadmanager WordPress plugin, in version 1.68.11 (also affecting the 6.9.4 release line), allows an admin-privileged user (current_user_can('manage_downloads')) to upload arbitrary files via download-add.php with no extension or MIME-type validation of any kind - no wp_check_filetype_and_ext(), no validate_file(), and no extension blocklist exist anywhere in the upload handler. The destination path is additionally built by concatenating the raw, unsanitized $_POST['file_upload_to'] value with no traversal check (no ../ filtering, no basename()/realpath() applied). Since the base download path is required to live under WP_CONTENT_DIR (a web-accessible location), an uploaded PHP file lands in a web-servable path and can be directly executed, resulting in remote code execution. The plugin's own later changelog confirms these protections were absent in this version: v1.69 added file-type validation via wp_check_filetype_and_ext(), and v1.69.1 added directory-traversal protection - neither existed in 1.68.11.
AnalysisAI
WP-DownloadManager WordPress plugin (all versions prior to 1.69) grants any WordPress administrator holding the manage_downloads capability the ability to achieve full remote code execution by uploading arbitrary PHP files through the unvalidated download-add.php handler. The upload path is additionally constructed from a raw, unsanitized POST parameter, enabling directory traversal into web-accessible locations under WP_CONTENT_DIR where uploaded PHP files execute on direct request. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the complete absence of server-side file-type controls and path sanitization makes exploitation trivially simple for any attacker who has obtained admin credentials.
Technical ContextAI
The vulnerability resides entirely in the PHP upload handler (download-add.php) of the WP-DownloadManager WordPress plugin (CPE: cpe:2.3:a:wp-downloadmanager:wp-downloadmanager:*:*:*:*:*:*:*:*). CWE-434 (Unrestricted Upload of File with Dangerous Type) is the primary root cause - the handler invokes neither WordPress's wp_check_filetype_and_ext() nor validate_file(), and maintains no extension or MIME-type blocklist. A compounding weakness analogous to CWE-22 (Path Traversal) exists because the upload destination directory is constructed by directly concatenating the raw $_POST['file_upload_to'] POST value with no sanitization - no basename(), realpath(), or ../ filtering is applied. WordPress mandates that the plugin's base download path reside under WP_CONTENT_DIR, a directory served by the web server, meaning any PHP file written there is directly executable via HTTP. The plugin's own changelogs for v1.69 (added wp_check_filetype_and_ext()) and v1.69.1 (added traversal protection) explicitly confirm both protections were entirely absent in 1.68.11 and earlier.
RemediationAI
Upgrade WP-DownloadManager to version 1.69.1 or later - this is the minimum version that addresses both the unrestricted file upload (fixed in v1.69 via wp_check_filetype_and_ext()) and the path traversal in the destination parameter (fixed in v1.69.1); upgrading to only v1.69 leaves the traversal vulnerability unaddressed. Updates can be applied directly from the WordPress admin Plugins page or via WP-CLI with 'wp plugin update wp-downloadmanager'. If an immediate upgrade is operationally blocked, the most effective interim compensating control is to revoke the manage_downloads capability from all non-essential administrator accounts, reducing the pool of users who can trigger the flaw; note this disables download management functionality for those accounts. A second option is to block HTTP access to download-add.php at the web server level via nginx location deny or Apache .htaccess rules, which prevents the upload form from being reached entirely at the cost of disabling the add-download workflow for all users. WAF rules targeting PHP extension uploads to wp-admin paths provide partial defense but are bypassable and should not substitute for patching. Refer to the plugin changelog at https://wordpress.org/plugins/wp-downloadmanager/ for release notes confirming fix versions.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today