WP File Download

WP File Download has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; all 3 are fixed as of September 2026. Their average CVSS score is 6.9, and the most serious one scores 8.1 out of 10. Severity breakdown: 0 critical and 1 high. 2026 was the busiest year with 2 disclosures.

The most common weakness is Path Traversal, behind 2 of the records (67%). Other recurring categories include Cross-Site Scripting.

Every one of the 3 issues recorded for WP File Download has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, most of them (2) reported by 0xd4rk5id3.

Strategic Overview

Avg CVSSMedium

6.9/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all WP File Download vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.1CVE-2026-14982

WP File Download <= 6.3.4 - Authenticated (Subscriber+) Arbitrary File Deletion via 'remoteurl' Parameter

Read the full analysis

Vulnerability Records

3 records


2026-09-04 18:31	WP File Download <= 6.3.8 - Authenticated (Subscriber+) Arbitrary File Read via Path Traversal in 'remoteurl' Parameter WP File Download <= 6.3.8	`CVE-2026-14975`	6.5 Medium	0xd4rk5id3	Yes
2026-09-01 13:55	WP File Download <= 6.3.4 - Authenticated (Subscriber+) Arbitrary File Deletion via 'remoteurl' Parameter WP File Download <= 6.3.4	`CVE-2026-14982`	8.1 High	0xd4rk5id3	Yes
2025-05-31 00:00	WP File Download <= 6.2.5 - Reflected Cross-Site Scripting WP File Download <= 6.2.5	`CVE-2025-5034`	6.1 Medium	Kevin Camus	Yes

Showing 1–3 of 3 reports