Read the docs
TI-2026-70198 Aliases CVE-2026-94538GHSA-cqx4-48wp-q2rc

Missing authorization in WP File Download allows file deletion

Priority LOW 35CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

The JoomUnited WP File Download plugin for WordPress is affected in versions through 6.3.9. Missing authorization checks (CWE-862) let the plugin perform actions without verifying that the user is allowed to perform them. Authenticated attackers with subscriber-level access or above can permanently delete any file managed by the plugin, empty the trash, move files between categories, and publish or unpublish arbitrary files.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The WP File Download plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.3.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently delete any file managed by WP File Download, empty the entire trash, move files between categories, and publish or unpublish arbitrary files.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00241 15th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
JoomUnitedWP File Downloadup to 6.3.9—No fix listedCNA
  • WP File Download VendorJoomUnited Affected up to 6.3.9 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for WP File Download.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-10 Threatist record created from CVE-2026-94538
  2. 2026-10-10 Alias added: GHSA-cqx4-48wp-q2rc
  3. 2026-10-11 Priority changed: MEDIUM → LOW
  4. 2026-10-11 CISA SSVC decision points changed

References

Other 2

  • TI-2023-01305 WP Meta SEO < 4.5.5 - Author+ PHAR Deserialization CVSS 3.1HIGH 8.8
  • TI-2023-00830 WP Meta SEO < 4.5.3 - Subscriber+ SQLi CVSS 3.1HIGH 8.8
  • TI-2025-04513 WP File Download < 6.2.6 - Reflected XSS CVSS 3.1HIGH 7.1
  • TI-2023-00831 WP Meta SEO < 4.5.3 - Subscriber+ Improper Authorization causing Arbitrary Redirect CVSS 3.1MEDIUM 6.1
  • TI-2024-17009 WordPress WP Media folder Plugin <= 5.7.2 is vulnerable to Arbitrary File Upload CVSS 3.1CRITICAL 9.9
  • TI-2026-08493 WordPress WP Media folder Addon plugin <= 4.0.1 - Arbitrary File Download vulnerability CVSS 3.1HIGH 7.5
See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences