Description

The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.8 via the 'remoteurl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. An authenticated attacker with Subscriber-level access first poisons the _wpfd_file_metadata['file'] post-meta value via the unprotected file.save handler, after which the streaming endpoint — hooked on init with no authentication requirement — resolves and streams the traversed file path to any caller, including unauthenticated visitors.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-05T07:17:10.560Z",
  "pubdate": "2026-09-05T07:17:10.560Z",
  "executiveSummary": "The WP File Download plugin for WordPress, in versions up to and including 6.3.8, is susceptible to an arbitrary file read vulnerability via directory traversal.\nThis vulnerability originates from insufficient input validation in the plugin's file handling mechanisms, specifically concerning the 'remoteurl' parameter.\nThe flaw allows an authenticated attacker with at least Subscriber-level privileges to manipulate file paths, enabling unauthorized access to sensitive system files.\nThe attack flow involves a two-stage process: an initial post-meta poisoning followed by the retrieval of the file via an unauthenticated streaming endpoint.\nSuccessful exploitation exposes confidential data stored on the server, potentially leading to a full compromise of sensitive configuration files or credentials.\nWhile an initial authentication requirement exists for the poisoning phase, the subsequent data extraction can be performed by unauthenticated actors due to the lack of access controls on the streaming endpoint.\nOrganizations using this plugin are advised to restrict access or apply available updates immediately to prevent unauthorized information disclosure.",
  "technicalDetails": "The vulnerability resides within the WP File Download plugin's handling of file metadata and subsequent file streaming operations. The root cause is a combination of improper input sanitization and insecure access control logic spanning two distinct components.\nIn the first phase of the attack, an attacker with authenticated access (Subscriber-level or higher) interacts with the file.save handler. This handler fails to adequately validate the input provided to the 'remoteurl' parameter. By supplying a crafted payload, the attacker successfully poisons the '_wpfd_file_metadata['file']' post-meta value within the WordPress database. This action effectively overwrites or inserts an arbitrary file path into the metadata associated with a file object managed by the plugin.\nThe second phase of the exploit utilizes a streaming endpoint which is registered via the 'init' hook in WordPress. A critical security failure exists in this endpoint, as it lacks any authentication requirement or capability check. When requested, the endpoint retrieves the previously poisoned file path from the '_wpfd_file_metadata['file']' meta field. Because the plugin does not properly sanitize or validate this path, it resolves the traversed path to arbitrary locations on the host filesystem.\nThe result is a directory traversal attack that forces the application to read and stream the contents of files outside the intended directories, potentially including sensitive files such as 'wp-config.php' or other system-level configuration files containing database credentials or security keys. Since the streaming endpoint is accessible without authentication, the sensitive data is returned in the HTTP response to any actor who requests the specifically targeted file index.\nThe scope of impact is significant because the combination of these two weaknesses bypasses standard WordPress permission models, allowing an attacker to escalate their impact from a low-privilege subscriber to an unauthorized reader of arbitrary filesystem contents. The vulnerability affects all versions up to 6.3.8 and demonstrates a failure to implement the principle of least privilege during file resolution processes."
}