The Download Manager plugin for WordPress (codename065) contains a CWE-22 path traversal vulnerability in the savePackage function that fails to properly restrict file paths. This flaw enables authenticated attackers with Author-level access or above to delete arbitrary files on the server. Deleting key files like wp-config.php can facilitate remote code execution. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges at the Author level, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix has been published as of the vulnerability disclosure date.

An attacker with Author-level or higher privileges can delete arbitrary files on the affected server, which can compromise the integrity and availability of the WordPress installation. Critical files such as wp-config.php can be deleted, potentially enabling remote code execution and full system compromise. This poses a significant risk to the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level access to trusted users only and consider disabling or removing the vulnerable Download Manager plugin to prevent exploitation.