WP File Download permits Subscriber-assisted arbitrary file read
WP File Download through 6.3.8 lets a Subscriber poison _wpfd_file_metadata['file'] through the unprotected file.save handler using the remoteurl input. A separate streaming path hooked on init resolves the traversed file path without authentication and returns the targeted server file to any caller.
- Component
- WP File Download
- Plugin slug
wp-file-download- Affected
- <= 6.3.8
- Safe version
- See mitigation notes
- Published
- Sep 05, 2026
This CVE was published Sep 05, 2026 and is one of 3 known issues for this plugin.
Update, patch or deactivate.
No confirmed fixed release is identified. Obtain a vendor-confirmed patch or disable the affected file-save and streaming functionality, then review low-privilege accounts, file metadata, and access logs and rotate secrets if sensitive files may have been read.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.8 via the 'remoteurl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. An authenticated attacker with Subscriber-level access first poisons the _wpfd_file_metadata['file'] post-meta value via the unprotected file.save handler, after which the streaming endpoint — hooked on init with no authentication requirement — resolves and streams the traversed file path to any caller, including unauthenticated visitors.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N