Path Traversal Vulnerability in WP-DownloadManager Plugin by WordPress

CVE-2026-2426

What is CVE-2026-2426?

The WP-DownloadManager plugin for WordPress allows authenticated users with Administrator access or higher to exploit a Path Traversal vulnerability via the 'file' parameter during file deletion operations. This flaw arises from inadequate validation of file paths submitted by users, enabling attackers to manipulate directory paths and potentially delete critical files on the server, such as wp-config.php. Such actions can lead to severe consequences, including unauthorized remote code execution and compromise of sensitive data.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References