CVE-2026-87935 ichurakov CVE debrief

Who should care

WordPress administrators and users of the Paid Downloads plugin should assess their exposure and apply necessary mitigations to prevent potential exploitation. This includes verifying if the WordPress installation is using Apache with AllowOverride enabled or other server stacks, and monitoring for suspicious file uploads and system changes.

Why it matters

CVE-2026-87935 is a high-severity vulnerability in the Paid Downloads plugin for WordPress, allowing arbitrary file uploads and potentially leading to remote code execution. WordPress administrators and users of this plugin should assess their exposure and apply updates or patches as soon as available.

• Remote code execution is possible if an attacker uploads a malicious executable file.
• Unauthenticated access to the admin_request_handler function allows for potential exploitation.
• The vulnerability affects all versions up to and including 3.15 of the Paid Downloads plugin.
• Verification of server stack configuration (e.g., Apache with AllowOverride) is necessary to understand exploitability.

Technical summary

The Paid Downloads plugin for WordPress is vulnerable to arbitrary file uploads due to missing authorization and file type validation in the admin_request_handler function. This function is reachable unauthenticated via is_admin() returning true for /wp-admin/admin-post.php, allowing unauthenticated attackers to upload potentially executable files, which can lead to remote code execution. The vulnerability affects all versions up to and including 3.15 of the Paid Downloads plugin. Verification of server stack configuration (e.g., Apache with AllowOverride) is necessary to understand exploitability. On Apache servers where AllowOverride is enabled, an .htaccess file placed in the upload directory may block HTTP

Defensive priority

High priority for WordPress administrators and users of the Paid Downloads plugin to assess exposure and apply mitigations.

Recommended defensive actions

• Assess exposure by checking if the Paid Downloads plugin version is 3.15 or earlier.
• Verify if the WordPress installation is using Apache with AllowOverride enabled or other server stacks.
• Apply updates or patches for the Paid Downloads plugin as soon as available.
• Monitor for suspicious file uploads and system changes.
• Consider implementing additional security measures such as web application firewalls.

Evidence notes

The vulnerability allows unauthenticated attackers to upload files that may be executable, potentially leading to remote code execution. The exploitability is limited on Apache servers with AllowOverride enabled, but not on stacks like nginx, LiteSpeed, and Apache with AllowOverride None.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.