CVE-2026-14975 JoomUnited CVE debrief

Who should care

WordPress administrators and security teams should assess exposure and prioritize remediation to prevent unauthorized file access. This includes reviewing the current plugin version, updating to a secure version if necessary, and monitoring for potential security breaches. Additionally, security teams should consider implementing compensating controls for exposed systems and tracking exceptions and retesting remediated assets.

Why it matters

The WP File Download plugin vulnerability allows authenticated attackers to read arbitrary files, posing a risk to sensitive information and data breaches. WordPress administrators and security teams should assess exposure and prioritize remediation.

• Read access to arbitrary files on the server, potentially exposing sensitive information.
• Increased risk of data breaches and unauthorized access to sensitive data.
• Potential for lateral movement and exploitation of other vulnerabilities.

Technical summary

The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.8 via the 'remoteurl' parameter. Authenticated attackers with subscriber-level access can read arbitrary files on the server, potentially exposing sensitive information. The vulnerability allows an attacker to poison the _wpfd_file_metadata['file'] post-meta value via the unprotected file.save handler, after which the streaming endpoint — hooked on init with no authentication requirement — resolves and streams the traversed file path to any caller, including unauthenticated visitors.

Defensive priority

Assess exposure, prioritize remediation, and monitor for unauthorized file access attempts.

Recommended defensive actions

• Assess exposure by checking if the WP File Download plugin version is within the vulnerable range.
• Prioritize remediation by updating the plugin to a version beyond 6.3.8.
• Monitor for unauthorized file access attempts and implement additional security measures to protect sensitive information.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability exists in all versions up to 6.3.8 of the WP File Download plugin. An attacker can poison the _wpfd_file_metadata['file'] post-meta value and then access the traversed file path through a streaming endpoint.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.