CVE-2026-94538: CWE-862 Missing Authorization in JoomUnited WP File Download

CVE-2026-94538 is a missing authorization vulnerability (CWE-862) in the WP File Download plugin for WordPress. The plugin fails to properly verify user authorization before allowing certain file management actions. As a result, authenticated users with low-level privileges (subscriber and above) can bypass intended access controls to delete files permanently, empty the trash, move files between categories, and change publication status of files. This vulnerability affects all plugin versions from 0 up to and including 6.3.9.

The vulnerability enables authenticated users with minimal privileges to perform high-impact unauthorized actions on files managed by the plugin. This includes permanent deletion of files, trash emptying, file category manipulation, and publishing or unpublishing files. Such actions can lead to data loss, content manipulation, and disruption of website functionality. The CVSS 3.1 base score is 8.1 (high severity), reflecting the network attack vector, low attack complexity, required privileges of low-level authenticated users, no user interaction, and high impact on integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is released, restrict user roles and permissions to limit access to the plugin's file management features. Monitor for updates from JoomUnited regarding a security update addressing this authorization bypass.