What the vulnerability does
01Description
The WP-DownloadManager plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.69 via the 'file' parameter in the file deletion functionality. This is due to insufficient validation of user-supplied file paths, allowing directory traversal sequences. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can lead to remote code execution when critical files like wp-config.php are deleted.
Explanation of Vulnerability in Simple Terms
02Summary
WP-DownloadManager versions 1.69 and earlier contain a path traversal vulnerability that allows authenticated administrators to read, modify, or delete arbitrary files on the server. An attacker with admin credentials can manipulate file paths to access files outside the intended download directory. Update to version 1.69.1 or later to patch this issue.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete arbitrary files on the server outside the plugin's intended directory.
Potential impact on your site
04Site Impact
An admin account compromise could lead to full site data loss, configuration file exposure, or malicious code injection.
Conditions required to exploit
05Prerequisites
Attacker must have WordPress administrator privileges; no user interaction required.
Key dates
06Disclosure timeline
February 18, 2026
CVE published
April 8, 2026
Record updated
