CVE-2026-18933

7.2 HIGH

Published 2026-08-05 · Updated 2026-08-10

AI risk analysis

Summary: The flaw allows admin users to upload arbitrary files without validation, posing a significant security risk.
Exploitability: Exploitation is relatively easy given admin privileges and no file type or extension checks are in place.
Blast radius: If exploited, this could lead to full server compromise or data leakage, affecting the entire system.
Prioritized remediation: Update to a non-affected version of wp-downloadmanager or remove the plugin entirely.

rceupload-bypasswordpress

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

The wp-downloadmanager WordPress plugin, in version 1.68.11 (also affecting the 6.9.4 release line), allows an admin-privileged user (current_user_can('manage_downloads')) to upload arbitrary files via download-add.php with no extension or MIME-type validation of any kind - no wp_check_filetype_and_ext, no validate_file, and no extension blocklist exist anywhere in the upload handler.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-434

All references

https://wordpress.org/plugins/wp-downloadmanager/#description

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.