CVE-2026-87935

The Paid Downloads plugin for WordPress, in all versions up to and including 3.15, exposes an arbitrary file upload flaw in its admin_request_handler function, which performs no authorization check and no file-type validation and is reachable by unauthenticated users because is_admin() returns true for requests to /wp-admin/admin-post.php. An unauthenticated attacker can therefore upload files directly to the site, including files the web server may execute, which makes remote code execution possible. Exploitability depends on the server stack: on Apache with AllowOverride enabled, an .htaccess file placed in the upload directory can block direct HTTP retrieval of uploaded files, so sites on nginx, LiteSpeed, or Apache with AllowOverride None are the most exposed. Any WordPress site running the plugin at version 3.15 or earlier is affected. As of this analysis the flaw is not on CISA's KEV list, no public proof-of-concept is known, and no in-the-wild exploitation has been confirmed.

What to do: Update the Paid Downloads plugin to a version newer than 3.15 as soon as a patched release is available; if no fix is published, deactivate and remove the plugin. Sites that must keep running it should block PHP execution and direct HTTP access to uploaded files at the web-server layer (an .htaccess deny rule is effective on Apache with AllowOverride enabled, while nginx and LiteSpeed sites need an equivalent server-level rule) and should review the uploads directory and admin-post.php access logs for suspicious .php uploads or .htaccess modifications.