CVE-2026-87935 in Paid Downloads Plugin
Summary
by MITRE • 09/17/2026
The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the admin_request_handler function. This is due to missing authorization and file type validation in the admin_request_handler function, which is reachable unauthenticated via is_admin() returning true for /wp-admin/admin-post.php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. On Apache servers where AllowOverride is enabled, an .htaccess file placed in the upload directory may block direct HTTP retrieval of uploaded files, limiting exploitability to stacks that do not honor .htaccess directives such as nginx, LiteSpeed, and Apache with AllowOverride None.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Paid Downloads plugin for WordPress contains a critical security vulnerability affecting all versions up to and including 3.15. This flaw is classified as an Arbitrary File Upload vulnerability, which falls under the Common Weakness Enumeration category CWE-434: Unrestricted Upload of File with Dangerous Type. The root cause lies within the admin_request_handler function, where there is a complete absence of proper authorization checks and file type validation mechanisms. In secure software design, administrative functions should strictly enforce authentication to ensure that only verified users can perform sensitive operations such as uploading files. However, in this implementation, the vulnerability allows unauthenticated actors to bypass these controls entirely.
The exploitability of this flaw is facilitated by how WordPress handles admin requests through the /wp-admin/admin-post.php endpoint. The function relies on the is_admin() check to determine access permissions, but due to a logical error or misconfiguration in the plugin's integration with this core mechanism, unauthenticated users can trigger the admin_request_handler function directly. This means that an attacker does not need valid credentials or any form of authentication to interact with the vulnerable code path. By sending specific HTTP requests to this endpoint, external actors can invoke the file upload functionality without being recognized as legitimate administrators.
Once the vulnerability is triggered, attackers are able to upload arbitrary files onto the server's filesystem. The lack of validation on file types means that malicious payloads, such as PHP scripts or other executable code, can be stored in the designated upload directory. This capability directly leads to Remote Code Execution (RCE), a severe outcome categorized under MITRE ATT&CK technique T1505: Server Software Component. If an attacker successfully uploads and subsequently executes these files, they gain full control over the underlying server environment. This level of access allows for data exfiltration, installation of backdoors, defacement of the website, or using the compromised server as a pivot point for further attacks against internal networks.
The practical impact and exploitability of this vulnerability are influenced by the web server configuration in use. On Apache servers where AllowOverride is enabled, administrators can place an .htaccess file within the upload directory to block direct HTTP retrieval of uploaded files. This mitigation strategy effectively neutralizes the immediate threat for many standard WordPress installations because it prevents attackers from accessing and executing their uploaded payloads via a browser or automated tools. However, this defense mechanism fails on web server stacks that do not honor Apache-specific directives like .htaccess. Consequently, environments running Nginx, LiteSpeed, or Apache configured with AllowOverride None remain fully vulnerable to exploitation. In these scenarios, the uploaded malicious files are directly accessible and executable by remote attackers without any additional configuration hurdles.
To mitigate this risk, immediate action is required for all systems using affected versions of the Paid Downloads plugin. The primary remediation step is to upgrade the plugin to a version newer than 3.15, where these authorization and validation flaws have presumably been addressed by the developers. For organizations unable to update immediately due to compatibility constraints or other operational reasons, temporary mitigations should be implemented at the web server level. Specifically, administrators using Apache with AllowOverride enabled should ensure that an .htaccess file is present in the upload directory containing rules to deny access to executable file types such as PHP files. Additionally, implementing strict Web Application Firewall (WAF) rules can help detect and block suspicious POST requests targeting admin-post.php from unauthenticated sources. Regular security audits and monitoring of server logs for unusual upload activities are also recommended to maintain a robust defense posture against similar vulnerabilities in the future.