CVE-2026-87935: WordPress Paid Downloads RCE Vulnerability

CVE-2026-87935 Overview

CVE-2026-87935 is an arbitrary file upload vulnerability in the Paid Downloads plugin for WordPress affecting all versions up to and including 3.15. The flaw resides in the admin_request_handler function, which lacks both authorization checks and file type validation. Because is_admin() returns true for requests to /wp-admin/admin-post.php, the handler is reachable by unauthenticated attackers. Successful exploitation allows attackers to upload executable files and achieve remote code execution on the underlying host. The issue is tracked under [CWE-434: Unrestricted Upload of File with Dangerous Type].

Critical Impact
Unauthenticated attackers can upload arbitrary files to WordPress sites running the Paid Downloads plugin, enabling remote code execution on vulnerable stacks.

Affected Products

Paid Downloads plugin for WordPress, all versions up to and including 3.15
WordPress sites served by nginx or LiteSpeed where .htaccess directives are ignored
Apache deployments configured with AllowOverride None

Discovery Timeline

2026-09-17 - CVE-2026-87935 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-87935

Vulnerability Analysis

The vulnerability sits in the admin_request_handler function of the Paid Downloads plugin. WordPress exposes /wp-admin/admin-post.php as an endpoint that any client can reach without authentication. Inside that request context, is_admin() returns true because it only reflects whether the admin interface is being loaded, not whether the caller is an authenticated administrator.

The plugin misinterprets this signal as proof of privileged access. As a result, the handler executes upload logic for anonymous requests. The handler also skips file type validation, so attackers can submit PHP payloads or other executable content directly.

Exploitation depends on the web server honoring or ignoring .htaccess files placed in the upload directory. Apache with AllowOverride enabled may block direct HTTP retrieval of the uploaded files. Nginx, LiteSpeed, and Apache with AllowOverride None do not honor those directives and remain fully exploitable.

Root Cause

Two defects combine to produce the flaw. First, the handler relies on is_admin() as an access control gate, which does not verify user capabilities. Second, no allow-list validation is applied to the uploaded file's MIME type or extension, violating [CWE-434].

Attack Vector

An unauthenticated attacker sends a crafted multipart POST request to /wp-admin/admin-post.php targeting the plugin's action. The request includes a malicious file such as a PHP web shell. Once written to the uploads directory, the attacker retrieves the file over HTTP and executes arbitrary code in the context of the web server user. See the Wordfence Vulnerability Analysis and the WordPress Plugin Code Snippet for the vulnerable handler location.

Detection Methods for CVE-2026-87935

Indicators of Compromise

Unauthenticated POST requests to /wp-admin/admin-post.php referencing Paid Downloads plugin actions
Newly created files with executable extensions such as .php, .phtml, or .phar inside the plugin's upload directory
Outbound network connections initiated by the web server user shortly after file uploads
Presence of .htaccess files in upload directories that were not created by administrators

Detection Strategies

Inspect HTTP access logs for POST requests to admin-post.php with Content-Type: multipart/form-data from unauthenticated sessions
Alert on writes to WordPress upload directories where the resulting filename contains a script extension
Monitor for child processes such as sh, bash, or python spawned by the PHP-FPM or web server process

Monitoring Recommendations

Enable file integrity monitoring on wp-content/uploads/ and plugin directories
Forward web server access and error logs to a centralized analytics platform for correlation
Baseline expected outbound connections from web nodes and alert on deviations

How to Mitigate CVE-2026-87935

Immediate Actions Required

Deactivate the Paid Downloads plugin until a patched release is installed
Audit the plugin's upload directory for unexpected files created since installation and remove any web shells
Review WordPress and web server logs for prior exploitation attempts against /wp-admin/admin-post.php
Rotate WordPress administrator credentials and API keys if compromise is suspected

Patch Information

At the time of publication, no fixed version has been identified in the NVD entry. Track the Wordfence Vulnerability Analysis and the plugin's repository for a release beyond 3.15 that addresses the missing authorization and file type validation in admin_request_handler.

Workarounds

Block unauthenticated access to /wp-admin/admin-post.php actions associated with the plugin at the WAF or reverse proxy layer
On nginx and LiteSpeed, add a location rule that denies execution of PHP files inside wp-content/uploads/
On Apache, enable AllowOverride so the plugin's .htaccess protections apply, or add equivalent server-level rules
Restrict write permissions on the uploads directory to the minimum required by the web server user

bash

# Nginx configuration example: block PHP execution in uploads
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}