CVE-2026-14982: WP File Download Path Traversal Vulnerability

CVE-2026-14982 Overview

The WP File Download plugin for WordPress contains an arbitrary file deletion vulnerability caused by insufficient file path validation in the delete function. Authenticated attackers with subscriber-level access or above can delete arbitrary files on the underlying server. Deleting sensitive files such as wp-config.php can lead to remote code execution when WordPress re-enters its installation state. The flaw affects all versions of the plugin and is categorized under CWE-22 (Path Traversal).

Critical Impact
A low-privileged WordPress subscriber can delete arbitrary server files through a two-stage request chain, enabling site takeover and potential remote code execution.

Affected Products

JoomUnited WP File Download plugin for WordPress (all versions)
WordPress installations exposing the plugin's file.save and file.delete task endpoints
Multisite WordPress deployments where subscribers can reach the affected AJAX handlers

Discovery Timeline

2026-09-02 - CVE-2026-14982 published to the National Vulnerability Database (NVD)
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-14982

Vulnerability Analysis

The vulnerability resides in WP File Download's file delete handler, which passes attacker-supplied path data to a PHP unlink call without validating that the resolved path stays within the plugin's managed upload directory. Because the deletion path is sourced from previously stored file metadata, exploitation requires two sequential requests. The first request invokes the file.save task to persist a path-traversal string (for example, sequences resolving to ../../../wp-config.php) into the file record. The second request invokes the file.delete task, which reads that stored path and unlinks the referenced file. Both endpoints are reachable by any authenticated user.

Root Cause

Two control failures combine to enable the attack. First, the plugin performs no canonicalization or allowlist check on file paths before invoking unlink, permitting directory traversal outside the intended storage root. Second, the file.save and file.delete task endpoints omit WordPress capability checks and nonce enforcement, so a subscriber-level account can reach code paths intended for administrators. Together these gaps convert stored metadata into an attacker-controlled file deletion primitive.

Attack Vector

Exploitation is remote and network-accessible over the WordPress admin-ajax or REST interface exposed by the plugin. An attacker authenticates with any account that has at least the subscriber role, submits a crafted file.save request to poison the stored path, and then issues a file.delete request to trigger unlink. Deleting wp-config.php forces WordPress into a re-installation state, which an attacker can use to attach the site to a database they control and achieve remote code execution. Deleting .htaccess, plugin files, or theme files can similarly weaken security controls or trigger denial of service.

No verified public exploit code is available at the time of publication. See the Wordfence vulnerability report for additional technical detail.

Detection Methods for CVE-2026-14982

Indicators of Compromise

Requests to admin-ajax.php or plugin REST routes containing task=file.save or task=file.delete with path values including ../, ..\, or absolute filesystem paths.
Missing or truncated wp-config.php, .htaccess, or core plugin files on hosts running WP File Download.
WordPress unexpectedly displaying the initial installation wizard, indicating that its configuration file was removed.
Subscriber-role accounts issuing authenticated POST requests to WP File Download endpoints they would not normally use.

Detection Strategies

Inspect web server logs for file.save requests where the persisted path, name, or file parameter contains traversal sequences.
Correlate a file.save request from a low-privilege user with a subsequent file.delete request from the same session as the two-stage exploit pattern.
Alert on file integrity monitoring events where WordPress core, plugin, or theme files are unlinked by the PHP-FPM or web server user outside a maintenance window.

Monitoring Recommendations

Enable file integrity monitoring on wp-config.php, .htaccess, and the wp-content/plugins and wp-content/themes directories.
Log all authenticated requests to WP File Download AJAX and REST endpoints, including the requesting user ID and role.
Forward WordPress and web server logs to a centralized analytics platform to detect the sequential file.save then file.delete pattern across sessions.

How to Mitigate CVE-2026-14982

Immediate Actions Required

Update WP File Download to the latest release listed in the JoomUnited changelog once the vendor publishes a fixed version.
Restrict registration and audit existing subscriber-level accounts, removing any that are unused or unverified.
Deploy a web application firewall rule that blocks requests to file.save and file.delete tasks containing path traversal sequences.
Back up wp-config.php, .htaccess, and the database before applying updates or investigating suspected exploitation.

Patch Information

JoomUnited maintains release notes on the WP File Download changelog. Administrators should apply the vendor-supplied patch that adds capability checks, nonce verification, and path canonicalization to the affected task handlers. Additional advisory content is available in the Wordfence vulnerability report.

Workarounds

Disable the WP File Download plugin until a patched version is installed if the plugin is not business-critical.
Restrict access to admin-ajax.php and plugin REST routes to authenticated users above the subscriber role using server-level access controls.
Set filesystem permissions so that the web server user cannot delete wp-config.php or files outside the plugin's designated upload directory.
Disable open user registration via Settings > General in WordPress to reduce the pool of accounts that can reach the vulnerable endpoints.

bash

# Example WordPress hardening: disable open registration and restrict file permissions
wp option update users_can_register 0
chmod 400 /var/www/html/wp-config.php
chown root:root /var/www/html/wp-config.php