CVE-2026-2419
WP-DownloadManager <= 1.69 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'download_path' Parameter
CVSS Score
2.7
EPSS Score
0.0%
EPSS Percentile
0th
The WP-DownloadManager plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.69 via the 'download_path' configuration parameter. This is due to insufficient validation of the download path setting, which allows directory traversal sequences to bypass the WP_CONTENT_DIR prefix check. This makes it possible for authenticated attackers, with Administrator-level access and above, to configure the plugin to list and access arbitrary files on the server by exploiting the file browser functionality.
| CWE | CWE-22 |
| Vendor | gamerz |
| Product | wp-downloadmanager |
| Published | Feb 18, 2026 |
| Last Updated | Apr 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for gamerz wp-downloadmanager
Be the first to know when new low vulnerabilities affecting gamerz wp-downloadmanager are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
gamerz / WP-DownloadManager
0 ≤ 1.69
References
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/0bb96da1-9c17-4264-ac29-b5ff8dec745d?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/wp-downloadmanager/trunk/download-options.php#L42 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/wp-downloadmanager/tags/1.69/download-options.php#L42 github.com: https://github.com/lesterchan/wp-downloadmanager/commit/416b9f5459496166c0395f9e055d4c4cf872404a
Credits
Sunnatillo Abdivasiyev