What is CVE-2026-18933?

CVE-2026-18933 is a high-severity vulnerability in Wp-Downloadmanager, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 7.2/10. Published 2026-08-05.

How severe is CVE-2026-18933?

High severity. CVSS v3 base score is 7.2 out of 10.

Arbitrary file upload in Wp-Downloadmanager

CVE-2026-18933

The wp-downloadmanager WordPress plugin, in version 1.68.11 (also affecting the 6.9.4 release line), allows an admin-privileged user (current_user_can('manage_downloads')) to upload arbitrary files via download-add.php with no extension or MIME-type validation of any kind - no wp_check_filetype_and_ext, no validate_file, and no extension blocklist exist anywhere in the upload handler.

Vulnerability class: Unrestricted File Upload

EPSS: 0.003 (20.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Affected products

Wp-downloadmanager — versions 0

Weakness classification (CWE)

CWE-434 — Unrestricted Upload of File with Dangerous Type

References

309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c (third-party-advisory)

Frequently asked questions

What is CVE-2026-18933?: CVE-2026-18933 is a high-severity vulnerability in Wp-Downloadmanager, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 7.2/10. Published 2026-08-05.
How severe is CVE-2026-18933?: High severity. CVSS v3 base score is 7.2 out of 10.