CVE-2026-14982: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in JoomUnited WP File Download

CVE-2026-14982 is a path traversal vulnerability (CWE-22) in the WP File Download WordPress plugin. It allows authenticated attackers with subscriber-level privileges or higher to delete arbitrary files on the server due to insufficient file path validation in the delete function. The exploit involves a two-stage process: a first request to the file.save task to store a path-traversal string in file metadata, followed by a second request to the file.delete task that triggers the unlink system call. Both endpoints lack capability checks and nonce enforcement, enabling unauthorized file deletion. This can lead to remote code execution if critical files such as wp-config.php are deleted.

An attacker with subscriber-level access or higher can delete arbitrary files on the server hosting the WordPress site. This can cause denial of service or enable remote code execution if critical files are removed. The vulnerability does not require user interaction and has a network attack vector with low attack complexity. It impacts integrity and availability but not confidentiality directly.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level access and monitor for suspicious activity. Because the vulnerability requires authenticated access and exploits lack nonce enforcement and capability checks, applying principle of least privilege and disabling or restricting the plugin may reduce risk.