CVE-2026-87935 is an arbitrary file upload vulnerability in the Paid Downloads WordPress plugin (<=3.15). The vulnerability arises from the admin_request_handler function lacking proper authorization and file type validation, accessible unauthenticated via is_admin() returning true for /wp-admin/admin-post.php. This allows attackers to upload files that may be executable, enabling remote code execution. Apache servers with AllowOverride enabled may mitigate direct HTTP access to uploaded files via .htaccess, but other server stacks without such protections remain vulnerable.

Successful exploitation allows unauthenticated attackers to upload arbitrary files, including executable ones, potentially leading to remote code execution. This compromises confidentiality, integrity, and availability of affected systems. The vulnerability has a high CVSS score of 8.1, reflecting its severity and impact. Exploitability depends on server configuration, with some servers limiting direct access to uploaded files.

No official patch or fix is currently provided for this vulnerability. Users should monitor the vendor advisory for updates. As a temporary mitigation, administrators can ensure that Apache servers have AllowOverride enabled to enforce .htaccess restrictions on upload directories, limiting direct HTTP access to uploaded files. Additionally, restricting server configurations that do not honor .htaccess directives (e.g., nginx, LiteSpeed, Apache with AllowOverride None) can reduce risk. Avoid exposing vulnerable plugin versions and consider disabling or removing the plugin until a fix is available.