wp-file-download

WP File Download through 6.3.8 lets a Subscriber poison _wpfd_file_metadata['file'] through the unprotected file.save handler using the remoteurl input. A separate streaming path hooked on init resolves the traversed file path without authentication and returns the targeted server file to any caller.

WP File Download through 6.3.4 exposes file.save and file.delete without capability or nonce enforcement. A Subscriber or higher can first persist a path-traversal value in file metadata through file.save, then invoke file.delete so the delete function passes that value to unlink(), deleting an arbitrary server file. Deleting a critical file such as wp-config.php can lead to site compromise or remote code execution.

wp-file-download is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.