{"id":"CVE-2026-94538","published":"2026-10-10T07:16:42.070","lastModified":"2026-10-13T13:29:12.567","description":"The WP File Download plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.3.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently delete any file managed by WP File Download, empty the entire trash, move files between categories, and publish or unpublish arbitrary files.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://www.joomunited.com/changelog/wp-file-download-changelog","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65b6cca9-46f4-452a-ad03-b72af76dfe99?source=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The WP File Download plugin has an authorization bypass flaw that allows authenticated users with subscriber-level access or higher to perform administrative file operations like deleting files, emptying trash, moving files between categories, and publishing/unpublishing arbitrary files. This is a significant security gap because it lets lower-privilege users gain access to powerful file management capabilities they shouldn't have.","exploitability":"Exploitation is relatively straightforward for authenticated attackers with subscriber-level access or higher, requiring only basic user credentials and no additional prerequisites.","blast_radius":"The impact could be substantial in WordPress environments where subscribers or lower-privilege users have access, potentially allowing them to delete critical files, manipulate content, or disrupt the entire file management system.","remediation":"Upgrade to version 6.3.10 or later to remediate this authorization bypass vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","wordpress","file-management"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:57:20.473Z"}}