CVE-2026-14982

Name of the Vulnerable Software and Affected Versions WP File Download versions prior to 6.3.5

Description Insufficient file path validation in the delete function allows authenticated attackers with subscriber-level access and above to delete arbitrary files on the server. This can lead to remote code execution if critical files like wp-config.php are removed. The exploit occurs in two stages: first, a request to the 'file.save' task persists a path-traversal string into file metadata using the remoteurl parameter; second, a request to the 'file.delete' task triggers the unlink call. Both endpoints lack capability checks and nonce enforcement (a security token used to prevent cross-site request forgery).

Recommendations Update WP File Download to version 6.3.5 or later. As a temporary workaround, restrict access to the 'file.save' and 'file.delete' tasks to prevent unauthorized file manipulation.