Kamol_Cs

**Name of the Vulnerable Software and Affected Versions** wp-downloadmanager versions 1.68.11 through 1.69.0 wp-downloadmanager versions 6.9.4 through 6.9.4 **Description** An admin-privileged user with `manage downloads` capabilities can upload arbitrary files through the 'download-add.php' endpoint. The upload handler lacks extension and MIME-type validation, failing to utilize functions like `wp check filetype and ext()` or `validate file()`. Additionally, the destination path is constructed using the unsanitized `file upload to` parameter without directory traversal checks, such as filtering `../` or using `basename()`. Because the base download path is located within a web-accessible directory, an attacker can upload and execute PHP files, leading to remote code execution. **Recommendations** Update wp-downloadmanager to version 1.69.1 or later. Update wp-downloadmanager to version 1.69.1 or later.