CVE-2026-94538

Summary

The WP File Download plugin has an authorization bypass flaw that allows authenticated users with subscriber-level access or higher to perform administrative file operations like deleting files, emptying trash, moving files between categories, and publishing/unpublishing arbitrary files. This is a significant security gap because it lets lower-privilege users gain access to powerful file management capabilities they shouldn't have.

Exploitability

Exploitation is relatively straightforward for authenticated attackers with subscriber-level access or higher, requiring only basic user credentials and no additional prerequisites.

Blast radius

The impact could be substantial in WordPress environments where subscribers or lower-privilege users have access, potentially allowing them to delete critical files, manipulate content, or disrupt the entire file management system.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 6.3.10 or later to remediate this authorization bypass vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.