CVE-2026-18933
Received Received - Intake

Remote Code Execution in WordPress Download Manager Plugin

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
The wp-downloadmanager WordPress plugin, in version 1.68.11 (also affecting the 6.9.4 release line), allows an admin-privileged user (current_user_can('manage_downloads')) to upload arbitrary files via download-add.php with no extension or MIME-type validation of any kind - no wp_check_filetype_and_ext(), no validate_file(), and no extension blocklist exist anywhere in the upload handler. The destination path is additionally built by concatenating the raw, unsanitized $_POST['file_upload_to'] value with no traversal check (no ../ filtering, no basename()/realpath() applied). Since the base download path is required to live under WP_CONTENT_DIR (a web-accessible location), an uploaded PHP file lands in a web-servable path and can be directly executed, resulting in remote code execution. The plugin's own later changelog confirms these protections were absent in this version: v1.69 added file-type validation via wp_check_filetype_and_ext(), and v1.69.1 added directory-traversal protection - neither existed in 1.68.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-18933
EUVD
EUVD-2026-53330

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
wp-downloadmanager wp-downloadmanager 1.68.11
wp-downloadmanager wp-downloadmanager From 1.68.11 (inc) to 1.69 (exc)
wp-downloadmanager wp-downloadmanager to 1.69.0 (exc)
wp-downloadmanager wp-downloadmanager From 1.69.0 (inc)
wp-downloadmanager wp-downloadmanager to 1.69.1 (inc)
wp_downloadmanager wp_downloadmanager 1.68.11
wp_downloadmanager wp_downloadmanager From 6.9.4 (inc)
wp_downloadmanager wp_downloadmanager to 1.69 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the wp-downloadmanager WordPress plugin versions 1.68.11 and 6.9.4. An admin user can upload arbitrary files without any validation of file type or extension. The upload path is constructed unsafely using user input, allowing directory traversal. Uploaded PHP files end up in a web-accessible directory and can be executed, leading to remote code execution.

Detection Guidance

Check for unauthorized PHP files in web-accessible directories under WP_CONTENT_DIR. Look for files uploaded via download-add.php with no extension or suspicious names. Review server logs for POST requests to download-add.php with file upload parameters.

Impact Analysis

If you are an admin user of a WordPress site using the vulnerable plugin version, an attacker with admin access could upload a malicious PHP file and execute arbitrary code on your server. This could lead to full system compromise, data theft, or further attacks on your infrastructure.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access control. Organizations may face legal penalties, fines, and reputational damage if exploited.

Mitigation Strategies

Upgrade the wp-downloadmanager plugin to version 1.69 or later to enable file-type validation and directory-traversal protection. If upgrading is not possible, disable the plugin immediately and remove any unauthorized files from web-accessible directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18933. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart