Path Traversal Vulnerability in WP-DownloadManager Plugin by WordPress

CVE-2026-2426

What is CVE-2026-2426?

The WP-DownloadManager plugin for WordPress allows authenticated users with Administrator access or higher to exploit a Path Traversal vulnerability via the 'file' parameter during file deletion operations. This flaw arises from inadequate validation of file paths submitted by users, enabling attackers to manipulate directory paths and potentially delete critical files on the server, such as wp-config.php. Such actions can lead to severe consequences, including unauthorized remote code execution and compromise of sensitive data.

References