Description

The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete function in all versions. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The two-stage exploit requires a first request to the file.save task to persist the path-traversal string into file metadata, followed by a second request to the file.delete task to trigger the unlink call — both endpoints lack capability checks and nonce enforcement.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-02T03:16:47.663Z",
  "pubdate": "2026-09-02T03:16:47.663Z",
  "executiveSummary": "The WP File Download plugin for WordPress is susceptible to an arbitrary file deletion vulnerability affecting all versions. This flaw stems from a critical lack of input validation and authorization checks within the plugin's file management functions. Authenticated attackers with subscriber-level privileges or higher can leverage this vulnerability to delete arbitrary files on the underlying filesystem by performing path traversal.\nThe security impact is severe, as the ability to delete arbitrary files often facilitates complete site compromise. By deleting critical configuration files such as 'wp-config.php', an attacker can force a re-installation of the WordPress application or redirect database connections, effectively leading to Remote Code Execution (RCE) or total loss of site control. The attack vector is two-staged, requiring an initial request to persist malicious metadata followed by a deletion request. Neither the 'file.save' task nor the 'file.delete' task enforces nonces or appropriate capability checks, allowing unauthorized users to manipulate server files with minimal effort. This vulnerability poses a significant risk to the integrity and availability of the affected WordPress installation.",
  "technicalDetails": "The vulnerability originates from insufficient sanitization of file paths processed by the WP File Download plugin's administrative tasks. The 'file.save' and 'file.delete' functions fail to validate that requested file operations remain within intended directory boundaries, enabling directory traversal attacks through malicious path strings.\nThe exploitation process follows a two-stage execution flow. In the first stage, an attacker sends a request to the 'file.save' endpoint. This request is designed to inject a path-traversal string—such as '../../wp-config.php'—into the file metadata stored by the plugin. Because the 'file.save' task lacks proper authorization verification, the application accepts and persists this malicious path regardless of the user's intent or privilege level.\nIn the second stage, the attacker triggers the 'file.delete' task. The application retrieves the previously saved, malformed path from its metadata storage and passes it directly to the underlying PHP 'unlink' function. Because 'unlink' operates at the system level, it follows the traversal path and deletes the targeted file. The absence of nonce enforcement and capability checks at the 'file.delete' endpoint ensures that the attacker's request is executed successfully without server-side resistance.\nThe vulnerability is present in all versions of the WP File Download plugin due to the fundamental lack of input validation and missing access control logic in these specific endpoints. Any user with a valid subscriber account—or any authenticated session—can leverage these endpoints to delete critical system files. The impact is exacerbated by the fact that the WordPress core files, plugins, or themes can be targeted, leading to denial-of-service or RCE scenarios. By deleting 'wp-config.php', for instance, the attacker can induce an application state where the site is forced into a fresh setup process, allowing the attacker to provide their own database credentials and assume full administrative control over the installation."
}