WordPress security changelog
MEDIUM CVE-2026-14975 Deferred

WP File Download permits Subscriber-assisted arbitrary file read

WP File Download through 6.3.8 lets a Subscriber poison _wpfd_file_metadata['file'] through the unprotected file.save handler using the remoteurl input. A separate streaming path hooked on init resolves the traversed file path without authentication and returns the targeted server file to any caller.

CVE / CNA score 6.5 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
WP File Download
Plugin slug
wp-file-download
Affected
<= 6.3.8
Safe version
See mitigation notes
Published
Sep 05, 2026
Weakness
CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

This CVE was published Sep 05, 2026 and is one of 3 known issues for this plugin.

Update, patch or deactivate.

No confirmed fixed release is identified. Obtain a vendor-confirmed patch or disable the affected file-save and streaming functionality, then review low-privilege accounts, file metadata, and access logs and rotate secrets if sensitive files may have been read.

No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Technical description

The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.8 via the 'remoteurl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. An authenticated attacker with Subscriber-level access first poisons the _wpfd_file_metadata['file'] post-meta value via the unprotected file.save handler, after which the streaming endpoint — hooked on init with no authentication requirement — resolves and streams the traversed file path to any caller, including unauthenticated visitors.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary and upstream sources