CVE-2026-2426mediumCWE-22

CVE-2026-2426: medium-severity vulnerability in gamerz WP-DownloadManager

WP-DownloadManager <= 1.69 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'file' Parameter

Published · Updated

Follow this CVE+ Monitor WP-DownloadManager

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 1.4%
The WP-DownloadManager plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.69 via the 'file' parameter in the file deletion functionality. This is due to insufficient validation of user-supplied file paths, allowing directory traversal sequences. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can lead to remote code execution when critical files like wp-config.php are deleted.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Affected products
gamerz · WP-DownloadManager
Related CVEs — gamerz WP-DownloadManager

In the same product, most dangerous first.

CVE-2025-4799HIGHWP-DownloadManager <= 1.68.10 - Authenticated (Administrator+) Arbitrary File DeletionEPSS 1.0%CVE-2026-2419LOWWP-DownloadManager <= 1.69 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'download_path' ParameterEPSS 0.8%CVE-2025-10747HIGHWP-DownloadManager <= 1.68.11 - Authenticated (Admin+) Arbitrary File UploadEPSS 0.7%CVE-2025-4798MEDIUMWP-DownloadManager <= 1.68.10 - Authenticated (Administrator+) Arbitrary File ReadEPSS 0.4%