CVE-2026-14982 JoomUnited CVE debrief

Who should care

WordPress administrators and users with subscriber-level access and above who use the WP File Download plugin should assess their exposure and take immediate action to prevent exploitation.

Why it matters

The WP File Download plugin vulnerability allows authenticated attackers to delete arbitrary files, potentially leading to remote code execution. WordPress administrators and users with subscriber-level access should assess their exposure and take immediate action to prevent exploitation.

• Remote code execution is possible if an attacker deletes a critical file such as wp-config.php.
• Arbitrary file deletion can lead to data loss and system instability.
• Authenticated attackers with low-level access can exploit this vulnerability.
• Verification of plugin versions and server logs is necessary to detect potential exploitation.

Technical summary

The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete function in all versions. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted, such as wp-config.php. The two-stage exploit requires a first request to the file.save task to persist the path-traversal string into file metadata, followed by a second request to the file.delete task to trigger the unlink call — both endpoints lack capability checks and nonce enforcement. The vulnerability allows attackers to delete files,

Defensive priority

High

Recommended defensive actions

• Review and update WP File Download plugin versions to ensure the latest security patches are applied.
• Restrict access to the file.save and file.delete tasks to prevent unauthorized use.
• Monitor server logs for suspicious file deletion attempts.
• Implement additional security measures such as file access controls and monitoring.
• Conduct a thorough review of server logs to detect potential exploitation attempts.
• Perform a comprehensive asset inventory to identify all instances of the WP File Download plugin.
• Establish a rollback change window for swift recovery in case of exploitation.

Evidence notes

The vulnerability exists in all versions of the WP File Download plugin due to insufficient file path validation in the delete function. An attacker can exploit this by making two requests: one to persist a path-traversal string into file metadata via the file.save task, and another to trigger the unlink call via the file.delete task. Both endpoints lack capability checks and nonce enforcement.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.