PT-2026-20380 · WordPress · Wp-Downloadmanager

Sunnatillo Abdivasiyev · Published 2026-02-18 · Updated 2026-02-18 · CVE-2026-2426

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP-DownloadManager versions prior to 1.69

Description The WP-DownloadManager plugin for WordPress is susceptible to a Path Traversal issue due to inadequate validation of file paths provided by users. This affects the file deletion functionality, specifically through the file parameter. Successful exploitation allows authenticated attackers with Administrator-level access or higher to delete arbitrary files on the server. Deletion of critical files, such as wp-config.php, could lead to remote code execution.

Recommendations Update WP-DownloadManager to a version newer than 1.69.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-2426

Affected Products

Wp-Downloadmanager

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-2426 · Security Note
• https://osv.dev/vulnerability/CVE-2026-2426 · Vendor Advisory
• https://github.com/lesterchan/wp-downloadmanager/commit/d3470a8971d9043438c8aad281cf37d14fefa208 · Note
• https://twitter.com/VulmonFeeds/status/2024112978379829249 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wp-downloadmanager/tags/1.69/download-manager.php#L215 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/a3f791dd-7c24-45e3-b4f6-b8d7e594c568?source=cve · Note
• https://twitter.com/CVEnew/status/2024090425699492251 · Twitter Post
• https://t.me/cveNotify/152305 · Telegram Post
• https://t.me/CVEtracker/44966 · Telegram Post
• https://plugins.trac.wordpress.org/browser/wp-downloadmanager/trunk/download-manager.php#L215 · Note