CVE-2026-18933
wp-downloadmanager - Unrestricted File Upload via Missing Extension/MIME Validation and Path Traversal
CVSS Score
7.2
EPSS Score
0.0%
EPSS Percentile
0th
The wp-downloadmanager WordPress plugin, in version 1.68.11 (also affecting the 6.9.4 release line), allows an admin-privileged user (current_user_can('manage_downloads')) to upload arbitrary files via download-add.php with no extension or MIME-type validation of any kind - no wp_check_filetype_and_ext, no validate_file, and no extension blocklist exist anywhere in the upload handler.
| CWE | CWE-434 |
| Vendor | wp-downloadmanager |
| Product | wp-downloadmanager |
| Published | Aug 5, 2026 |
| Last Updated | Aug 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for wp-downloadmanager wp-downloadmanager
Be the first to know when new high vulnerabilities affecting wp-downloadmanager wp-downloadmanager are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
wp-downloadmanager / wp-downloadmanager
0 ≤ 1.69
References
Credits
Kamol_cs