PT-2026-20380 · WordPress · Wp-Downloadmanager

Sunnatillo Abdivasiyev · Publicado 2026-02-18 · Atualizado 2026-02-18 · CVE-2026-2426

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP-DownloadManager versions prior to 1.69

Description The WP-DownloadManager plugin for WordPress is susceptible to a Path Traversal issue due to inadequate validation of file paths provided by users. This affects the file deletion functionality, specifically through the file parameter. Successful exploitation allows authenticated attackers with Administrator-level access or higher to delete arbitrary files on the server. Deletion of critical files, such as wp-config.php, could lead to remote code execution.

Recommendations Update WP-DownloadManager to a version newer than 1.69.

Correção

RCE

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-2426

Produtos afetados

Wp-Downloadmanager

Referências · 10

• https://github.com/lesterchan/wp-downloadmanager/commit/d3470a8971d9043438c8aad281cf37d14fefa208 · Nota
• https://twitter.com/VulmonFeeds/status/2024112978379829249 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/wp-downloadmanager/tags/1.69/download-manager.php#L215 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/a3f791dd-7c24-45e3-b4f6-b8d7e594c568?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-2426 · Nota de Segurança
• https://twitter.com/CVEnew/status/2024090425699492251 · Publicação no Twitter
• https://t.me/cveNotify/152305 · Publicação no Telegram
• https://t.me/CVEtracker/44966 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-2426 · Aviso do Fabricante
• https://plugins.trac.wordpress.org/browser/wp-downloadmanager/trunk/download-manager.php#L215 · Nota