CVE-2026-94538 Details
Description
The WP File Download plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.3.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently delete any file managed by WP File Download, empty the entire trash, move files between categories, and publish or unpublish arbitrary files.
A vulnerability exists in the WP File Download plugin for WordPress, affecting all versions through 6.3.9. The issue stems from the plugin's failure to properly verify user authorization, enabling authenticated users with subscriber-level access and above to bypass restrictions. This vulnerability allows for the permanent deletion of any file managed by the plugin, emptying the entire trash, moving files between categories, and publishing or unpublishing arbitrary files.
Users are advised to update the WP File Download plugin to version 6.3.10 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 10, 2026CISA-ADP
Assessed Oct 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.joomunited.com/changelog/wp-file-download-changelog | [email protected] | Release NotesVendor |
| https://www.wordfence.com/threat-intel/vulnerabilities/id/65b6cca9-46f4-452a-ad03-b72af76dfe99?source=cve | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WP File Download | <= 6.3.9 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 11, 2026 | CVE Modified | CISA-ADP |
| Oct 10, 2026 | New CVE Received | [email protected] |