EUVD-2026-81334
GHSA-8qvx-4h8h-jjwf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend unauthenticated POST to admin-post.php
-
DeliveryReach admin_request_handler via is_admin() true
-
ExploitUpload PHP file (no type check)
-
ExecutionRequest uploaded file over HTTP
-
ImpactExecute code as web user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication or user interaction is required: the admin_request_handler function is reachable unauthenticated because is_admin() returns true for requests to /wp-admin/admin-post.php, and the handler performs neither a capability check nor file-type validation. The KEY LIMITING factor is server configuration for the final code-execution step - on Apache with AllowOverride enabled, a plugin-placed .htaccess in the upload directory can block direct HTTP retrieval of the uploaded file, so reliable RCE is confined to stacks that do not honor .htaccess: nginx, LiteSpeed, or Apache configured with AllowOverride None. The upload/authorization bypass itself works regardless of stack; only retrieval/execution is gated by the web server's .htaccess handling. |
| Impact | This is a genuine high-priority issue, not merely a high-CVSS paper risk. The CVSS 3.1 base is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H): remote, unauthenticated, and yielding full C/I/A compromise via arbitrary file upload leading to RCE. The single tempering signal is AC:H, which is well-justified here - the description explains that exploitability is conditional on the server stack: on Apache with AllowOverride enabled, an .htaccess in the upload directory can block direct HTTP retrieval of the uploaded payload, so reliable code execution is limited to stacks that ignore .htaccess (nginx, LiteSpeed, or Apache with AllowOverride None). No EPSS score, KEV entry, POC, or SSVC decision data was provided in the input, so exploitation-likelihood and automatability cannot be quantified from these signals; absence of KEV/POC is not evidence of safety, especially for an unauthenticated WordPress RCE class that is historically mass-scanned once public. The authorization flaw is concrete and vendor-confirmed by Wordfence with direct source-line references, so the technical vulnerability itself is well-substantiated even though real-world exploitation telemetry is missing. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted POST to /wp-admin/admin-post.php that reaches the admin_request_handler function, which trusts is_admin() returning true and performs no capability check or file-type validation, allowing upload of a PHP payload. On a non-.htaccess-honoring stack (nginx, LiteSpeed, or Apache with AllowOverride None) the attacker then requests the uploaded file directly to execute it, gaining remote code execution as the web user. No public exploit was identified at time of analysis, but the attack requires no authentication and no user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Unauthenticated arbitrary file upload in the Paid Downloads WordPress plugin (all versions up to and including 3.15) lets remote attackers bypass authorization and file-type checks in the admin_request_handler function to place attacker-controlled files on the server, which can lead to remote code execution. The flaw is reachable without credentials because is_admin() returns true for requests to /wp-admin/admin-post.php, and the handler performs neither a capability check nor an extension/content validation; per assessment, the AC:H rating reflects that reliable code execution depends on server configuration - Apache deployments with AllowOverride enabled may have retrieval of the uploaded file blocked by a plugin-placed .htaccess, confining dependable RCE to nginx, LiteSpeed, or Apache with AllowOverride None, while the upload and authorization bypass itself succeeds on any stack. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, but the unauthenticated upload primitive combined with a CVSS 8.1 score makes this a high-priority, patch-dependent risk for any site running the plugin.
RemediationAI
No vendor-released patch was identified in the available data at time of analysis - the references point to the vulnerable 3.15 source rather than a fixed release - so the primary action is to deactivate and remove the Paid Downloads plugin from any WordPress site until an updated version is published and verified; because this is a plugin flaw rather than a WordPress core issue, there is no core version to upgrade to as a fix, and sites that depend on the plugin should treat removal as an accepted availability trade-off against an unauthenticated upload-to-RCE primitive. If the plugin cannot be removed, apply layered compensating controls, each with caveats: block unauthenticated POSTs to /wp-admin/admin-post.php at the WAF or reverse proxy for the plugin's action parameter, but note this is fragile and will break legitimate front-end handlers from other plugins that intentionally use admin-post.php without a session; alternatively require valid authentication for admin-post.php requests, accepting the same breakage; and on the server side, deny script execution in the WordPress uploads directory with native configuration - an nginx location block rejecting .php (and variants) under /wp-content/uploads/, or Apache with php_admin_flag engine off / RemoveHandler inside a <Directory> directive - because relying on the plugin's own .htaccess protection is unsafe: .htaccess is ignored by nginx and LiteSpeed and by Apache where AllowOverride is None, and an attacker who can upload an .htaccess can also replace it. Enforce a strict upload allowlist at the WAF for any traffic reaching the plugin and monitor the uploads directory for newly written PHP files as a detection backstop, understanding that detection does not prevent the initial unauthenticated upload. Consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/3f0251e5-e575-4662-b81d-72c106e92b50?source=cve for status updates and any newly released fixed version.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic CWE-434 (Unrestricted Upload of File with Dangerous Type) manifesting inside a WordPress plugin. Paid Downloads registers a handler named admin_request_handler and wires it to admin-post.php, the WordPress admin endpoint that dispatches to handlers registered via admin_post_{action}. WordPress's is_admin() function returns true for any request routed through /wp-admin/, including admin-post.php, even when the caller has no session, no cookies, and no valid credentials - it is a path check, not an authentication or capability check. Because the handler trusts is_admin() as its access control and then performs no current_user_can() capability check and no validation of the uploaded file's name, extension, MIME type, or content, an unauthenticated attacker can POST a file and have it written into a web-reachable location. The second half of the exploit chain is execution: PHP files landing in a web-served directory will execute on any stack that treats that directory as script-capable. The references point to the plugin source at tags/3.15 (paid-downloads.php lines 79, 941, 1036, and 1902), which is the vulnerable revision; the CPE cpe:2.3:a:ichurakov:paid_downloads:*:*:*:*:*:*:*:* confirms the affected package is the ichurakov Paid Downloads plugin across its version range. The assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H matches this analysis: unauthenticated (PR:N) and network-reachable (AV:N), with the high attack complexity (AC:H) deriving entirely from the environment-dependent execution step rather than from the upload bypass.
Know when Paid Downloads gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated upload (AV:N/PR:N/UI:N) yielding full RCE (C:H/I:H/A:H); AC:H because reliable code execution depends on a server stack that ignores .htaccess protections.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the admin_request_handler function. This is due to missing authorization and file type validation in the admin_request_handler function, which is reachable unauthenticated via is_admin() returning true for /wp-admin/admin-post.php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. On Apache servers where AllowOverride is enabled, an .htaccess file placed in the upload directory may block direct HTTP retrieval of uploaded files, limiting exploitability to stacks that do not honor .htaccess directives such as nginx, LiteSpeed, and Apache with AllowOverride None.
Executive ViewAI
The Paid Downloads WordPress plugin (versions up to 3.15) contains a high-severity flaw that allows remote attackers to bypass authorization and file-type checks to upload malicious files, potentially leading to remote code execution on web servers. Organizations using this plugin on nginx, LiteSpeed, or Apache with AllowOverride None are at risk of full server compromise, while other configurations may still suffer unauthorized file uploads. With no vendor-released patch identified at time of analysis and no public exploit identified, leadership should prioritize immediate mitigation to prevent data breaches and service disruption.
No vendor patch available. Interim mitigations include disabling the Paid Downloads plugin, restricting access to /wp-admin/admin-post.php via IP allowlisting or WAF rules, blocking file uploads to the plugin's handler, configuring the web server to prevent execution of uploaded files (e.g., disabling PHP in wp-content/uploads), and monitoring logs for suspicious upload activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB