The wp-downloadmanager WordPress plugin in version 1.68.11 and the 6.9.4 release line allows an admin-privileged user (with 'manage_downloads' capability) to upload arbitrary files via download-add.php without any MIME-type or extension validation functions such as wp_check_filetype_and_ext() or validate_file(). Additionally, the upload destination path is constructed by concatenating the unsanitized $_POST['file_upload_to'] parameter without any directory traversal checks, allowing placement of files outside intended directories. Since the base download path is under WP_CONTENT_DIR, which is web-accessible, an attacker can upload a PHP file that can be executed remotely, resulting in remote code execution. The plugin changelog confirms these protections were absent in 1.68.11, with fixes introduced in versions 1.69 (file-type validation) and 1.69.1 (directory traversal protection).

An attacker with admin privileges can upload arbitrary files, including executable PHP scripts, to a web-accessible directory, enabling remote code execution. This compromises confidentiality, integrity, and availability of the affected WordPress site. The vulnerability requires admin-level privileges but allows full server-side code execution once exploited.

Upgrade the wp-downloadmanager plugin to version 1.69 or later, where file-type validation and directory traversal protections have been implemented. These fixes prevent arbitrary file uploads and restrict upload paths to safe locations. Until upgraded, restrict admin user access to trusted personnel only.