CVE-2026-14975

Name of the Vulnerable Software and Affected Versions WP File Download versions prior to 6.3.9

Description An issue exists where authenticated attackers with subscriber-level access and above can read arbitrary files on the server. This is achieved by poisoning the wpfd file metadata['file'] post-meta value through the unprotected file.save() handler using the remoteurl parameter. Subsequently, a streaming endpoint hooked on init, which does not require authentication, resolves and streams the traversed file path to any requester, including unauthenticated visitors. Directory Traversal is a method used to access files and directories that are stored outside the web root folder.

Recommendations Update WP File Download to version 6.3.9 or later. Restrict access to the file.save() handler to prevent unauthorized modification of post-meta values.