PT-2026-20314 · WordPress · Wp-Downloadmanager

Sunnatillo Abdivasiyev · Publicado 2026-02-18 · Atualizado 2026-02-18 · CVE-2026-2419

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Baixa

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WP-DownloadManager plugin for WordPress versions prior to 1.70

Description The WP-DownloadManager plugin for WordPress is susceptible to a Path Traversal issue due to inadequate validation of the download path configuration parameter. This allows attackers with Administrator-level access or higher to bypass the WP CONTENT DIR prefix check and potentially access arbitrary files on the server through the file browser functionality. The issue exists because of insufficient validation of the download path setting.

Recommendations Update the WP-DownloadManager plugin to version 1.70 or later.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-2419

Produtos afetados

Wp-Downloadmanager

Referências · 9

• https://github.com/lesterchan/wp-downloadmanager/commit/416b9f5459496166c0395f9e055d4c4cf872404a · Nota
• https://t.me/CVEtracker/44948 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-2419 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/wp-downloadmanager/tags/1.69/download-options.php#L42 · Nota
• https://plugins.trac.wordpress.org/browser/wp-downloadmanager/trunk/download-options.php#L42 · Nota
• https://twitter.com/VulmonFeeds/status/2024146259397714335 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/0bb96da1-9c17-4264-ac29-b5ff8dec745d?source=cve · Nota
• https://twitter.com/CVEnew/status/2024038168303915427 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-2419 · Aviso do Fabricante