WP File Download: Missing authorization allows file deletion and modification
Summary
The WP File Download WordPress plugin up to and including version 6.3.9 lacks proper authorization checks on several file-management functions. An authenticated user with Subscriber role or higher can permanently delete files, empty the trash, move files between categories, and publish or unpublish arbitrary files. The attack requires a logged-in account, and the CNA data reports no confidentiality impact.
Affected
- WP File Download (JoomUnited) versions 0 to and including 6.3.9
- Exploitation requires an account with Subscriber role or higher
Fixed in
- Vendor changelog lists a fix for the missing authorization checks in an entry dated 21 Oct 2026, placed above version 6.3.9
- Fixed version number not confirmed; a third-party source names 6.3.10 or later, which is not verified by the vendor
- Check the plugin update screen or the vendor changelog for the exact version
Workaround
- No vendor-documented workaround.
- Restrict or remove unnecessary low-privilege accounts and disable open self-registration where possible.
Exploitation
- CISA KEV: not listed
- CISA SSVC: exploitation none, automatable no, technical impact partial
- No known exploitation in the wild and no public proof of concept found at the time of research
- EPSS about 0.00248 (very low)
Our recommendation
- Update WP File Download to the latest version from JoomUnited, at least 6.3.10 or the version named in the vendor changelog.
- Review all Subscriber and other low-privilege accounts, especially self-registered ones, and remove unneeded accounts.
- Confirm that current, restorable backups of the media library exist.
- Check recent file deletions and publish or unpublish changes in the plugin.
- Prioritise this on sites with open registration or many low-privilege users; medium priority for internal-only sites.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WP File Download Changelog (JoomUnited) www.joomunited.com
- Wordfence Threat Intelligence record www.wordfence.com
- OpenCVE CVE-2026-94538 app.opencve.io
- VulDB CVE-2026-94538 vuldb.com
- Strix CVE-2026-94538 www.strix.ai
- RedPacket Security CVE alert www.redpacketsecurity.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:16.
Original description (NVD)
The WP File Download plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.3.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently delete any file managed by WP File Download, empty the entire trash, move files between categories, and publish or unpublish arbitrary files.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.