CVE-2026-18933

Received Received - Intake

Remote Code Execution in WordPress Download Manager Plugin

Publication date: 2026-08-05

Last updated on: 2026-08-10

Assigner: TuranSec

Description

The wp-downloadmanager WordPress plugin, in version 1.68.11 (also affecting the 6.9.4 release line), allows an admin-privileged user (current_user_can('manage_downloads')) to upload arbitrary files via download-add.php with no extension or MIME-type validation of any kind - no wp_check_filetype_and_ext, no validate_file, and no extension blocklist exist anywhere in the upload handler.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-10

Generated

2026-08-25

AI Q&A

2026-08-05

EPSS Evaluated

2026-08-24

NVD

CVE-2026-18933

EUVD

EUVD-2026-53330

Affected Vendors & Products

Vendor	Product	Version / Range
wp-downloadmanager	wp-downloadmanager	1.68.11
wp-downloadmanager	wp-downloadmanager	From 1.68.11 (inc) to 1.69 (exc)
wp_download_manager	wp_download_manager	to 1.69.0 (exc)
wp_download_manager	wp_download_manager	From 1.68.11 (inc) to 1.69.1 (inc)
wp_downloadmanager	wp_downloadmanager	From 1.68.11 (inc) to 1.69 (exc)
wp-downloadmanager	wp-downloadmanager	to 1.69.0 (exc)
wp-downloadmanager	wp-downloadmanager	From 1.69.0 (inc)
wp-downloadmanager	wp-downloadmanager	to 1.69.1 (inc)
wp_downloadmanager	wp_downloadmanager	1.68.11
wp_downloadmanager	wp_downloadmanager	From 6.9.4 (inc)
wp_downloadmanager	wp_downloadmanager	6.9.4
wp_downloadmanager	wp_downloadmanager	to 1.69 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

This vulnerability affects the wp-downloadmanager WordPress plugin versions 1.68.11 and 6.9.4. An admin user can upload arbitrary files without any validation of file type or extension. The upload path is constructed unsafely using user input, allowing directory traversal. Uploaded PHP files end up in a web-accessible directory and can be executed, leading to remote code execution.

Detection Guidance

Check for unauthorized PHP files in web-accessible directories under WP_CONTENT_DIR. Look for files uploaded via download-add.php with no extension or suspicious names. Review server logs for POST requests to download-add.php with file upload parameters.

Impact Analysis

If you are an admin user of a WordPress site using the vulnerable plugin version, an attacker with admin access could upload a malicious PHP file and execute arbitrary code on your server. This could lead to full system compromise, data theft, or further attacks on your infrastructure.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access control. Organizations may face legal penalties, fines, and reputational damage if exploited.

Mitigation Strategies

Upgrade the wp-downloadmanager plugin to version 1.69 or later to enable file-type validation and directory-traversal protection. If upgrading is not possible, disable the plugin immediately and remove any unauthorized files from web-accessible directories.

Hi! I’m here to help you understand CVE-2026-18933. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70