Paid Downloads
Monthly
Unauthenticated arbitrary file upload in the Paid Downloads WordPress plugin (all versions up to and including 3.15) lets remote attackers bypass authorization and file-type checks in the admin_request_handler function to place attacker-controlled files on the server, which can lead to remote code execution. The flaw is reachable without credentials because is_admin() returns true for requests to /wp-admin/admin-post.php, and the handler performs neither a capability check nor an extension/content validation; per assessment, the AC:H rating reflects that reliable code execution depends on server configuration - Apache deployments with AllowOverride enabled may have retrieval of the uploaded file blocked by a plugin-placed .htaccess, confining dependable RCE to nginx, LiteSpeed, or Apache with AllowOverride None, while the upload and authorization bypass itself succeeds on any stack. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, but the unauthenticated upload primitive combined with a CVSS 8.1 score makes this a high-priority, patch-dependent risk for any site running the plugin.
Unauthenticated arbitrary file upload in the Paid Downloads WordPress plugin (all versions up to and including 3.15) lets remote attackers bypass authorization and file-type checks in the admin_request_handler function to place attacker-controlled files on the server, which can lead to remote code execution. The flaw is reachable without credentials because is_admin() returns true for requests to /wp-admin/admin-post.php, and the handler performs neither a capability check nor an extension/content validation; per assessment, the AC:H rating reflects that reliable code execution depends on server configuration - Apache deployments with AllowOverride enabled may have retrieval of the uploaded file blocked by a plugin-placed .htaccess, confining dependable RCE to nginx, LiteSpeed, or Apache with AllowOverride None, while the upload and authorization bypass itself succeeds on any stack. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, but the unauthenticated upload primitive combined with a CVSS 8.1 score makes this a high-priority, patch-dependent risk for any site running the plugin.