CVE-2026-87935

Name of the Vulnerable Software and Affected Versions Paid Downloads versions prior to 3.16

Description The Paid Downloads plugin for WordPress allows unauthenticated arbitrary file upload through the admin request handler() function. This occurs because the function lacks proper authorization and file type validation and is accessible via the /wp-admin/admin-post.php endpoint. An attacker can upload executable files to achieve remote code execution. The exploitability is limited on Apache servers where AllowOverride is enabled due to potential .htaccess restrictions in the upload directory, but it remains effective on nginx, LiteSpeed, and Apache configurations with AllowOverride None.

Recommendations Update the plugin to a version newer than 3.15.