CVE-2026-94538

Name of the Vulnerable Software and Affected Versions WP File Download versions prior to 6.4.0

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can permanently delete any file managed by the plugin, empty the trash, move files between categories, and publish or unpublish arbitrary files.

Recommendations Update WP File Download to version 6.4.0 or later.