The Download Plugin for WordPress by metagauss suffers from an unrestricted file upload vulnerability (CWE-434) in the dpwap_plugin_locInstall function. This vulnerability exists in all versions up to 2.2.8 and permits authenticated administrators to upload files without proper validation of file types. Such arbitrary file uploads can enable attackers to place malicious files on the server, which may lead to remote code execution. The CVSS 3.1 base score is 7.2, reflecting high impact on confidentiality, integrity, and availability with low attack complexity but requiring high privileges.

An attacker with Administrator-level access can upload arbitrary files to the server hosting the vulnerable WordPress plugin. This can lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system. The vulnerability does not appear to be exploited in the wild yet. Because exploitation requires authenticated high-privilege access, the risk is limited to insiders or compromised administrator accounts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator-level access to trusted users only and monitor for suspicious file uploads. Consider disabling or removing the Download Plugin if not essential. Follow vendor updates closely for any forthcoming patches or official mitigations.