CVE-2026-14975: WP File Download Path Traversal Vulnerability

CVE-2026-14975 Overview

The WP File Download plugin for WordPress contains a directory traversal vulnerability [CWE-22] affecting all versions up to and including 6.3.8. The flaw resides in the handling of the remoteurl parameter. Authenticated attackers holding Subscriber-level access or higher can read arbitrary files on the underlying server. Attackers first poison the _wpfd_file_metadata['file'] post-meta value through the unprotected file.save handler. The streaming endpoint, hooked on init without an authentication check, then resolves and streams the traversed file path to any caller, including unauthenticated visitors.

Critical Impact
Authenticated attackers with minimal privileges can exfiltrate sensitive server files, including wp-config.php, application secrets, and credentials, that enable further compromise.

Affected Products

JoomUnited WP File Download plugin for WordPress
All versions up to and including 6.3.8
WordPress sites permitting Subscriber-level registration

Discovery Timeline

2026-09-05 - CVE-2026-14975 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-14975

Vulnerability Analysis

The vulnerability is a two-stage directory traversal in the WP File Download plugin. The first stage abuses the file.save handler, which lacks capability checks and accepts input from any authenticated user. An attacker submits a crafted remoteurl parameter that overwrites the _wpfd_file_metadata['file'] post-meta value with a traversal path such as ../../../../wp-config.php. The second stage triggers a public streaming endpoint registered on WordPress's init action. Because the endpoint performs no authentication, capability, or path validation, it reads the poisoned meta value, resolves it relative to the plugin's upload directory, and streams the target file to the caller. The chained flaw allows reading any file readable by the web server process.

Root Cause

Two defects combine to produce the vulnerability. The file.save handler fails to enforce the WordPress capability model, permitting Subscribers to modify post metadata they should not control. The streaming endpoint compounds the issue by trusting attacker-controlled metadata and omitting path normalization or realpath validation against an allowlisted base directory.

Attack Vector

Exploitation requires network access to the WordPress site and an authenticated account at Subscriber level or above. On sites that permit open registration, this prerequisite is trivial to satisfy. The attacker sends a POST request to the plugin's file.save action containing a remoteurl value crafted with directory traversal sequences. After metadata poisoning, the attacker (or an unauthenticated third party) issues a GET request to the streaming endpoint referencing the poisoned post identifier. The server returns the contents of the traversed file. Refer to the Wordfence vulnerability analysis and the plugin source in the WordPress Plugin repository for implementation specifics.

Detection Methods for CVE-2026-14975

Indicators of Compromise

POST requests to WP File Download endpoints containing remoteurl parameters with traversal sequences such as ../, ..%2f, or absolute paths targeting wp-config.php.
GET requests to the plugin's streaming endpoint returning non-media MIME types or content matching known configuration file signatures.
Unexpected modifications to post meta entries containing the _wpfd_file_metadata key, particularly values referencing paths outside the plugin's upload directory.
New Subscriber-level accounts created shortly before suspicious plugin traffic.

Detection Strategies

Inspect web server access logs for action=wpfd or plugin-specific parameters combined with traversal patterns in query strings or POST bodies.
Query the wp_postmeta table for _wpfd_file_metadata values containing .., /etc/, wp-config, or absolute filesystem paths.
Correlate low-privilege authenticated sessions with subsequent unauthenticated downloads from the plugin's streaming route.

Monitoring Recommendations

Enable WordPress audit logging to record post meta changes attributed to non-administrator accounts.
Forward web server and WordPress logs to a centralized SIEM for retention and correlation across authentication and file access events.
Alert on outbound responses from WordPress that return wp-config.php byte patterns such as DB_PASSWORD or AUTH_KEY literals.

How to Mitigate CVE-2026-14975

Immediate Actions Required

Update the WP File Download plugin to a version later than 6.3.8 once the vendor publishes a fix. Review the JoomUnited WP File Download changelog for release status.
Disable open user registration or restrict registration to trusted email domains until the plugin is patched.
Rotate all secrets stored in wp-config.php, including database credentials, salts, and API keys, if exploitation is suspected.
Audit wp_postmeta for poisoned _wpfd_file_metadata entries and remove or sanitize any values containing traversal sequences.

Patch Information

As of the CVE publication date, users must monitor the JoomUnited WP File Download changelog and the WordPress plugin repository for a fixed release addressing the file.save handler and the unauthenticated init streaming endpoint. Apply the update to all WordPress installations running the plugin.

Workarounds

Deactivate the WP File Download plugin until a patched release is available if the plugin is not business-critical.
Deploy a web application firewall rule that blocks requests containing traversal patterns in the remoteurl parameter or the plugin's action handlers.
Restrict access to the plugin's streaming endpoint at the reverse proxy layer to authenticated administrative sessions.
Remove or downgrade Subscriber-level accounts that do not require site access.

bash

# Example WAF rule pattern (ModSecurity)
SecRule ARGS:remoteurl "@rx (\.\./|\.\.%2f|/etc/|wp-config)" \
    "id:1014975,phase:2,deny,status:403,\
     msg:'CVE-2026-14975 WP File Download traversal attempt'"