github.com
https://github.com/lesterchan/wp-downloadmanager/commit/d3470a8971d9043438c8aad281cf37d14fefa208 CVE-2026-2426
MEDIUM
WP-DownloadManager <= 1.69 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'file' Parameter
Record summary
CVE-2026-2426 has a selected CVSS score of 6.5 (medium).
Description
The WP-DownloadManager plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.69 via the 'file' parameter in the file deletion functionality. This is due to insufficient validation of user-supplied file paths, allowing directory traversal sequences. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can lead to remote code execution when critical files like wp-config.php are deleted.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 18, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
WP-DownloadManagerBrowse gamerz / WP-DownloadManagerDefault status: unaffected | CVE List | Through 1.69 | affected |
References
5nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-2426 plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/wp-downloadmanager/tags/1.69/download-manager.php plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/wp-downloadmanager/trunk/download-manager.php wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/a3f791dd-7c24-45e3-b4f6-b8d7e594c568?source=cve