CVE-2026-2426: WP-DownloadManager Path Traversal Flaw

CVE-2026-2426 Overview

A Path Traversal vulnerability exists in the WP-DownloadManager plugin for WordPress in all versions up to and including 1.69. The vulnerability is present in the file deletion functionality due to insufficient validation of user-supplied file paths via the file parameter. This flaw allows directory traversal sequences to be passed, enabling authenticated attackers with Administrator-level access to delete arbitrary files on the server. When critical files such as wp-config.php are deleted, this can lead to remote code execution.

Critical Impact

Authenticated attackers with Administrator privileges can delete arbitrary files on the server, potentially leading to remote code execution by removing critical configuration files like wp-config.php.

Affected Products

• WP-DownloadManager plugin for WordPress versions up to and including 1.69

Discovery Timeline

• 2026-02-18 - CVE CVE-2026-2426 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-2426

Vulnerability Analysis

This Path Traversal vulnerability (CWE-22) exists in the WP-DownloadManager plugin's file deletion functionality. The core issue stems from the application trusting user-supplied input in the file parameter without adequate validation or sanitization. When processing file deletion requests, the plugin fails to properly validate that the specified file path remains within the intended directory structure.

An authenticated attacker with Administrator-level access can exploit this vulnerability by crafting a malicious request containing directory traversal sequences (e.g., ../) in the file parameter. This allows the attacker to navigate outside the intended download directory and target arbitrary files on the server's filesystem.

The most severe exploitation scenario involves deleting the WordPress configuration file (wp-config.php), which can trigger WordPress's installation process and potentially allow an attacker to reconfigure the site with malicious settings, effectively achieving remote code execution.

Root Cause

The vulnerability exists because the plugin relied on trusting form POST data for file paths without proper validation. The original code accepted the file parameter directly from user input and used it for file operations without sanitizing directory traversal sequences or verifying that the target path remained within the expected upload directory.

Attack Vector

The attack requires network access and authenticated Administrator-level credentials. An attacker can exploit this vulnerability by:

1. Authenticating to WordPress with Administrator privileges
2. Navigating to the WP-DownloadManager file management interface
3. Intercepting or crafting a file deletion request
4. Modifying the file parameter to include directory traversal sequences (e.g., ../../../wp-config.php)
5. Submitting the malicious request to delete arbitrary files outside the intended directory

The following patch was applied to address this vulnerability by fetching the file using file_id instead of trusting the form POST data, and adding file type validation:

 			if( $file_upload_to !== '/' ) {
 				$file_upload_to = $file_upload_to . '/';
 			}
-			if(move_uploaded_file($_FILES['file_upload']['tmp_name'], $file_path.$file_upload_to.basename($_FILES['file_upload']['name']))) {
-				$file = $file_upload_to.basename($_FILES['file_upload']['name']);
-				$file = download_rename_file($file_path, $file);
-				$file_size = filesize($file_path.$file);
+			$validate = wp_check_filetype_and_ext( $_FILES['file_upload']['tmp_name'], basename( $_FILES['file_upload']['name'] ) );
+			if ( $validate['type'] === false ) {
+					$text = '<p style="color: red;">' . __('File type is invalid', 'wp-downloadmanager') . '</p>';
+					break;
+			}
+			if( move_uploaded_file( $_FILES['file_upload']['tmp_name'], $file_path.$file_upload_to . basename( $_FILES['file_upload']['name'] ) ) ) {
+				$file = $file_upload_to . basename( $_FILES['file_upload']['name'] );
+				$file = download_rename_file( $file_path, $file );
+				$file_size = filesize( $file_path . $file );
 			} else {
-				$text = '<p style="color: red;">'.__('Error In Uploading File', 'wp-downloadmanager').'</p>';
+				$text = '<p style="color: red;">' . __('Error In Uploading File', 'wp-downloadmanager') . '</p>';
 				break;
 			}
 		} else {
-			$text = '<p style="color: red;">'.__('Error In Uploading File', 'wp-downloadmanager').'</p>';
+			$text = '<p style="color: red;">' . __('Error In Uploading File', 'wp-downloadmanager') . '</p>';
 			break;
 		}
 	}

Source: GitHub Commit Update

Detection Methods for CVE-2026-2426

Indicators of Compromise

• Unexpected deletion of critical WordPress files such as wp-config.php, .htaccess, or core plugin files
• Web server error logs showing requests to WP-DownloadManager endpoints with directory traversal sequences (../) in parameters
• WordPress installation wizard appearing unexpectedly (indicating wp-config.php deletion)
• Audit logs showing file deletion operations targeting paths outside the download directory

Detection Strategies

• Monitor HTTP request logs for the file parameter containing directory traversal patterns such as ../, ..%2F, or encoded variants in requests to WP-DownloadManager
• Implement file integrity monitoring (FIM) to detect unauthorized deletion of critical WordPress files
• Configure web application firewalls (WAF) to block requests containing path traversal sequences in POST parameters
• Review WordPress admin activity logs for suspicious file management operations

Monitoring Recommendations

• Enable detailed access logging on web servers to capture full request parameters
• Set up alerts for modifications or deletions of critical WordPress configuration files
• Monitor for HTTP 404 errors or application errors following file deletion attempts that may indicate exploitation
• Implement real-time alerting for any admin-level file operations within the WP-DownloadManager plugin

How to Mitigate CVE-2026-2426

Immediate Actions Required

• Update WP-DownloadManager plugin to version 1.69.1 or later immediately
• Review server logs for any evidence of exploitation attempts
• Verify integrity of critical WordPress files including wp-config.php, .htaccess, and core files
• Consider temporarily disabling the WP-DownloadManager plugin until the update can be applied

Patch Information

The vulnerability has been addressed in version 1.69.1 of the WP-DownloadManager plugin. The fix modifies the file handling logic to fetch file information using file_id from the database rather than trusting user-supplied file path data from form POST parameters. Additionally, file type validation has been implemented using wp_check_filetype_and_ext().

The security patch is available via the GitHub Commit. For detailed vulnerability information, refer to the Wordfence Vulnerability Report.

Workarounds

• Restrict Administrator access to only trusted users until the patch is applied
• Implement web application firewall rules to block requests containing directory traversal patterns in POST parameters
• Use file system permissions to protect critical files (e.g., make wp-config.php read-only)
• Disable the WP-DownloadManager plugin temporarily if it is not essential for site operations

# Configuration example: Protect wp-config.php with file permissions
chmod 440 wp-config.php
chown root:www-data wp-config.php

# Apache .htaccess rule to block directory traversal attempts
# Add to WordPress root .htaccess file
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} (\.\./|\.\.%2F) [NC,OR]
    RewriteCond %{REQUEST_BODY} (\.\./|\.\.%2F) [NC]
    RewriteRule .* - [F,L]
</IfModule>