What the vulnerability does
01Description
The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file deletion due to lack of restriction on the directory a file can be deleted from in all versions up to, and including, 1.68.10. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability can be paired with CVE-2025-4798 to delete any file within the WordPress root directory.
Explanation of Vulnerability in Simple Terms
02Summary
WP-DownloadManager versions 1.68.10 and earlier contain a path traversal vulnerability that allows authenticated administrators to read, write, or delete arbitrary files on the server. An attacker with admin privileges can exploit this to access sensitive configuration files, modify site content, or disable the site entirely. Update to version 1.69.1 or later.
What an attacker can do
03Attacker Capabilities
Read, write, or delete arbitrary files on the server with admin-level access.
Potential impact on your site
04Site Impact
An admin account compromise could lead to full server file system access and potential site takeover.
Conditions required to exploit
05Prerequisites
Attacker must have WordPress administrator privileges and network access to the site.
Key dates
06Disclosure timeline
June 11, 2025
CVE published
April 8, 2026
Record updated
