CVE-2026-14975: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in JoomUnited WP File Download

CVE-2026-14975 is a directory traversal vulnerability (CWE-22) in the WP File Download WordPress plugin affecting all versions up to 6.3.8. An attacker with subscriber-level authentication can manipulate the _wpfd_file_metadata['file'] post-meta value using an unprotected file.save handler. Subsequently, a streaming endpoint hooked on WordPress init, which lacks authentication, streams the contents of the traversed file path to any requester, including unauthenticated visitors. This allows unauthorized reading of arbitrary files on the server, potentially exposing sensitive information.

The vulnerability allows an authenticated attacker with low-level privileges (subscriber) to cause the server to disclose arbitrary file contents to any user, including unauthenticated visitors. This can lead to exposure of sensitive information stored on the server. There is no indication of integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level access where possible and monitor for suspicious activity related to the file.save handler and streaming endpoint. Avoid exposing the vulnerable plugin or disable it if feasible.