WP File Download CVE-2026-94538

Exploitation requires an authenticated account with at least subscriber-level privileges on a WordPress site running the WP File Download plugin version 6.3.9 or earlier; the flaw lies in the plugin failing to verify that the caller is authorized for the requested action. The practical limiting factor is this authentication requirement (PR:L) - attackers cannot exploit it fully unauthenticated - but the barrier is low because subscriber is the lowest WordPress role and is often available via open self-registration. No special non-default plugin configuration is indicated as necessary; the condition is simply the presence of a vulnerable version and a low-privilege account.

The CVSS 3.1 base score of 8.1 (High) is driven by a network attack vector (AV:N), low complexity (AC:L), no user interaction (UI:N), and high integrity and availability impact (I:H/A:H) with no confidentiality impact (C:N). Critically, the vector specifies PR:L, meaning exploitation requires authentication - the description confirms only subscriber-level access is needed, which is the lowest meaningful privilege tier on most WordPress sites and is often self-registerable, so this barrier is low in practice. No EPSS score, CISA KEV listing, or SSVC decision data was provided in the input, and no public exploit was identified; the only reporting source is Wordfence. There is no signal of active exploitation, so this is a genuinely high-severity authorization flaw whose real-world priority hinges on whether affected sites allow open user registration - on sites that do, the low auth bar makes it a meaningful priority; on sites restricted to trusted users, the practical risk is reduced. No conflicting signals were observed between the CVSS vector and the description - both agree on authenticated remote exploitation.

An attacker registers (or already holds) a subscriber-level account on a WordPress site running WP File Download 6.3.9 or earlier, then sends crafted authenticated requests to the plugin's action handlers that fail to verify the caller's authorization. With no further privileges, they permanently delete files, empty the trash, move files between categories, or toggle publish state - destroying or tampering with managed content. No public proof-of-concept was identified at the time of analysis.