WP File Download vulnerabilities

2 known vulnerabilities in WP File Download from JoomUnited. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  WP File Download: Missing Authorization

  CVE-2026-94538Oct 10, 2026JoomUnited

  The WP File Download plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.3.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticat

• 8.1 High severity

  WP File Download: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-14982Sep 2, 2026JoomUnited

  The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete function in all versions. This makes it possible for authenticated attackers, with subscriber-level access and above, to d