CVE-2026-2426 is a path traversal vulnerability in the WP-DownloadManager WordPress plugin affecting all versions up to 1.69. It allows authenticated users with Administrator privileges to manipulate the 'file' parameter in the file deletion functionality to traverse directories and delete arbitrary files on the server. This improper limitation of pathname access (CWE-22) can lead to deletion of critical files, such as wp-config.php, which may enable remote code execution. The vulnerability has a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and high availability impact. No patch or vendor advisory is currently provided.

An authenticated attacker with Administrator-level access can exploit this vulnerability to delete arbitrary files on the server hosting the WordPress site. Deletion of critical files like wp-config.php may lead to remote code execution or site disruption. The integrity and availability of the affected system are impacted, but confidentiality is not directly affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Administrator access to trusted users only and monitor for suspicious activity related to file deletion. Avoid using vulnerable versions of the WP-DownloadManager plugin if possible. Follow vendor communications for updates on patches or mitigations.