Wp-downloadmanager Plugin up to 1.68 on WordPress Upload download-add.php wp_check_filetype_and_ext file_upload_to unrestricted upload

Summaryinfo

A vulnerability was found in Wp-downloadmanager Plugin up to 1.68 and classified as problematic. This vulnerability affects the function wp_check_filetype_and_ext of the file download-add.php of the component Upload Handler. Such manipulation of the argument file_upload_to leads to unrestricted upload. This vulnerability is referenced as CVE-2026-18933. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in Wp-downloadmanager Plugin up to 1.68. It has been rated as problematic. Affected by this issue is the function wp_check_filetype_and_ext of the file download-add.php of the component Upload Handler. The manipulation of the argument file_upload_to with an unknown input leads to a unrestricted upload vulnerability. Using CWE to declare the problem leads to CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. Impacted is confidentiality, integrity, and availability. CVE summarizes:

The wp-downloadmanager WordPress plugin, in version 1.68.11 (also affecting the 6.9.4 release line), allows an admin-privileged user (current_user_can('manage_downloads')) to upload arbitrary files via download-add.php with no extension or MIME-type validation of any kind - no wp_check_filetype_and_ext(), no validate_file(), and no extension blocklist exist anywhere in the upload handler. The destination path is additionally built by concatenating the raw, unsanitized $_POST['file_upload_to'] value with no traversal check (no ../ filtering, no basename()/realpath() applied). Since the base download path is required to live under WP_CONTENT_DIR (a web-accessible location), an uploaded PHP file lands in a web-servable path and can be directly executed, resulting in remote code execution. The plugin's own later changelog confirms these protections were absent in this version: v1.69 added file-type validation via wp_check_filetype_and_ext(), and v1.69.1 added directory-traversal protection - neither existed in 1.68.11.

The advisory is shared for download at wordpress.org. This vulnerability is handled as CVE-2026-18933 since 08/05/2026. The exploitation is known to be easy. The attack may be launched remotely. The exploitation requires an enhanced level of successful authentication. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1608.002.

By approaching the search of inurl:download-add.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.69 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Name

• Wp-downloadmanager Plugin

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31
• 1.32
• 1.33
• 1.34
• 1.35
• 1.36
• 1.37
• 1.38
• 1.39
• 1.40
• 1.41
• 1.42
• 1.43
• 1.44
• 1.45
• 1.46
• 1.47
• 1.48
• 1.49
• 1.50
• 1.51
• 1.52
• 1.53
• 1.54
• 1.55
• 1.56
• 1.57
• 1.58
• 1.59
• 1.60
• 1.61
• 1.62
• 1.63
• 1.64
• 1.65
• 1.66
• 1.67
• 1.68

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion