CVE-2026-14982

WP File Download, a WordPress plugin for managing downloadable files, contains an arbitrary file deletion flaw caused by insufficient file path validation (CWE-22) in its delete routine, and the data indicates all versions are affected. An authenticated attacker with subscriber-level access or higher exploits it in two stages: a request to the file.save task stores a crafted path-traversal string in the file metadata, and a second request to the file.delete task triggers an unlink call on the attacker-chosen path; neither endpoint enforces capability checks or nonce verification. By deleting critical files such as wp-config.php, the attacker can compromise the site, which can easily escalate to remote code execution when the right file is removed. Any WordPress installation with this plugin active is exposed, because even the lowest-privileged role (subscriber) is sufficient to exploit it. As of the data provided there is no known public proof-of-concept, the issue is not listed in CISA's KEV, and EPSS estimates a 0.5% probability of exploitation within 30 days.

What to do: Update WP File Download to the latest patched release as soon as one is available; the advisory marks all versions affected and does not name a fixed version, so confirm the patched release with the vendor. Until patched, consider disabling the plugin or restricting subscriber-level registrations, and check that critical files such as wp-config.php are intact. No in-the-wild exploitation is confirmed, but monitor vendor advisories given the low privilege required to exploit.