CVE-2026-18933: WP-DownloadManager WordPress RCE Flaw

CVE-2026-18933 Overview

CVE-2026-18933 is an arbitrary file upload vulnerability in the wp-downloadmanager WordPress plugin, version 1.68.11 and the 6.9.4 release line. The upload handler in download-add.php accepts files from any user with the manage_downloads capability without validating extensions or MIME types. Attackers can additionally control the destination path through the unsanitized $_POST['file_upload_to'] parameter, enabling directory traversal into web-servable locations under WP_CONTENT_DIR. Uploading a PHP file yields direct remote code execution on the WordPress host. The issue is classified under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
An authenticated administrator with the manage_downloads capability can execute arbitrary PHP on the server by uploading a malicious file to a web-accessible directory.

Affected Products

wp-downloadmanager WordPress plugin version 1.68.11
wp-downloadmanager WordPress plugin release line 6.9.4
WordPress installations where WP_CONTENT_DIR is web-accessible and the plugin is active

Discovery Timeline

2026-08-05 - CVE-2026-18933 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-18933

Vulnerability Analysis

The plugin exposes an administrative upload endpoint in download-add.php gated only by the current_user_can('manage_downloads') capability check. The handler writes user-supplied file contents to disk without inspecting the file extension, MIME type, or content signature. No call to wp_check_filetype_and_ext(), no invocation of validate_file(), and no extension blocklist exists in the upload path.

Because the plugin stores downloads beneath WP_CONTENT_DIR, a location served by the web server, any file written there is reachable over HTTP. Requesting an uploaded .php file causes the PHP interpreter to execute its contents, giving the attacker code execution under the web server user.

The plugin's own changelog corroborates the gap: version 1.69 introduced file-type validation via wp_check_filetype_and_ext(), and 1.69.1 added directory-traversal protection. Neither control existed in 1.68.11.

Root Cause

The root cause is the absence of input validation on both the uploaded file and the destination path. The handler trusts the administrative role instead of enforcing content-based controls. The destination is built by concatenating the raw $_POST['file_upload_to'] value with no basename(), realpath(), or traversal filtering, allowing writes outside the intended downloads/ directory.

Attack Vector

An attacker with manage_downloads privileges submits a multipart POST request to download-add.php. The request includes a PHP payload as the uploaded file and a file_upload_to value pointing to a web-accessible subdirectory under WP_CONTENT_DIR. After the write succeeds, the attacker issues a GET request to the resulting URL to trigger execution. Compromise of any account holding manage_downloads, whether through phishing, credential stuffing, or role escalation, results in full server takeover.

No public exploit code is currently referenced in the CVE data. See the WordPress plugin page for background on the plugin's file handling.

Detection Methods for CVE-2026-18933

Indicators of Compromise

New .php, .phtml, or .phar files appearing under wp-content/ paths associated with the plugin's downloads directory
HTTP POST requests to download-add.php from administrative sessions followed by GET requests to newly created files under wp-content/
Web server processes (php-fpm, www-data, apache) spawning shells, curl, wget, or outbound connections
Unexpected modifications to wp-content timestamps or ownership after plugin usage

Detection Strategies

Alert on file creation events where the parent process is the PHP interpreter and the file extension matches known executable web types
Correlate authenticated WordPress admin actions with subsequent access to newly written files in wp-content/
Baseline the contents of the plugin's download directory and flag deviations, especially files with executable extensions
Inspect access logs for POST /wp-admin/admin.php?page=download-add or requests referencing file_upload_to parameters containing ../

Monitoring Recommendations

Enable file integrity monitoring on wp-content/ and its subdirectories
Forward WordPress audit logs, PHP-FPM logs, and web server access logs to a centralized analytics platform
Monitor outbound network connections initiated by the web server user for signs of reverse shells or payload retrieval
Track creation of scheduled tasks, cron entries, or new admin users following plugin upload activity

How to Mitigate CVE-2026-18933

Immediate Actions Required

Upgrade wp-downloadmanager to version 1.69.1 or later, which adds both file-type validation and directory-traversal protection
Audit all accounts holding the manage_downloads capability and revoke it from non-essential users
Rotate credentials for any administrative account that could have used the plugin during the exposure window
Search wp-content/ for unexpected .php, .phtml, and .phar files and remove any that are not part of a known plugin or theme

Patch Information

The vendor addressed the vulnerability across two releases. Version 1.69 introduced wp_check_filetype_and_ext() validation of uploaded files. Version 1.69.1 added directory-traversal protection by sanitizing the destination path. Upgrade to 1.69.1 or later to receive both fixes. See the WordPress plugin page for release information.

Workarounds

Deactivate and remove the wp-downloadmanager plugin until the patched version is deployed
Configure the web server to deny execution of PHP files within the plugin's download directory using .htaccess rules or Nginx location blocks
Restrict the manage_downloads capability to a minimal set of trusted administrators
Place the WordPress admin interface behind IP allowlists or multi-factor authentication to raise the barrier for capability abuse

bash

# Apache: disable PHP execution inside the downloads directory
# Place in wp-content/downloads/.htaccess
<FilesMatch "\.(php|phtml|phar|php7|phps)$">
    Require all denied
</FilesMatch>

# Nginx equivalent (server block)
location ~* /wp-content/downloads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}