CVE-2026-18933

Name of the Vulnerable Software and Affected Versions wp-downloadmanager versions 1.68.11 through 1.69.0 wp-downloadmanager versions 6.9.4 through 6.9.4

Description An admin-privileged user with manage downloads capabilities can upload arbitrary files through the 'download-add.php' endpoint. The upload handler lacks extension and MIME-type validation, failing to utilize functions like wp check filetype and ext() or validate file(). Additionally, the destination path is constructed using the unsanitized file upload to parameter without directory traversal checks, such as filtering ../ or using basename(). Because the base download path is located within a web-accessible directory, an attacker can upload and execute PHP files, leading to remote code execution.

Recommendations Update wp-downloadmanager to version 1.69.1 or later. Update wp-downloadmanager to version 1.69.1 or later.