PT-2026-20314 · WordPress · Wp-Downloadmanager

Sunnatillo Abdivasiyev · Published 2026-02-18 · Updated 2026-02-18 · CVE-2026-2419

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WP-DownloadManager plugin for WordPress versions prior to 1.70

Description The WP-DownloadManager plugin for WordPress is susceptible to a Path Traversal issue due to inadequate validation of the download path configuration parameter. This allows attackers with Administrator-level access or higher to bypass the WP CONTENT DIR prefix check and potentially access arbitrary files on the server through the file browser functionality. The issue exists because of insufficient validation of the download path setting.

Recommendations Update the WP-DownloadManager plugin to version 1.70 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-2419

Affected Products

Wp-Downloadmanager

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-2419 · Security Note
• https://osv.dev/vulnerability/CVE-2026-2419 · Vendor Advisory
• https://github.com/lesterchan/wp-downloadmanager/commit/416b9f5459496166c0395f9e055d4c4cf872404a · Note
• https://t.me/CVEtracker/44948 · Telegram Post
• https://plugins.trac.wordpress.org/browser/wp-downloadmanager/tags/1.69/download-options.php#L42 · Note
• https://plugins.trac.wordpress.org/browser/wp-downloadmanager/trunk/download-options.php#L42 · Note
• https://twitter.com/VulmonFeeds/status/2024146259397714335 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/0bb96da1-9c17-4264-ac29-b5ff8dec745d?source=cve · Note
• https://twitter.com/CVEnew/status/2024038168303915427 · Twitter Post