Arbitrary File Deletion Vulnerability in WP File Download by WordPress

CVE-2026-14982

What is CVE-2026-14982?

The WP File Download plugin for WordPress is compromised by an arbitrary file deletion vulnerability stemming from inadequate file path validation in its delete function. This flaw allows authenticated users, with subscriber-level rights or higher, to erase arbitrary files from the server. A successful exploit can result in significant security breaches, such as remote code execution, particularly if critical files like wp-config.php are targeted. The exploit process is twofold: the initial request to the file.save task embeds the path-traversal string into the file's metadata, while a subsequent request to the file.delete task activates the unlink command, exploiting the lack of capability checks and nonce validation on both endpoints.

References