Security Alert Summary
The Paid Downloads WordPress plugin contains an arbitrary file upload vulnerability in versions up to and including 3.15. The issue stems from missing authorization and file type validation in the admin_request_handler function, which can be reached unauthenticated via /wp-admin/admin-post.php when is_admin() returns true. Uploaded files may be executable, which can enable remote code execution on affected server stacks that do not enforce .htaccess directives.
CVE Details
- CVE ID:
CVE-2026-87935 - Affected component: Paid Downloads plugin for WordPress (admin_request_handler)
- Affected versions: All versions up to and including 3.15
- Published: September 17, 2026 at 5:17:02 AM
- Last modified: September 17, 2026 at 5:17:02 AM
- CVSS v3.1: Base Score 8.1, Severity HIGH, Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Authentication / privileges / user interaction: Authentication not required (unauthenticated); Privileges required: None; User interaction: None
- Primary impact: Confidentiality: High; Integrity: High; Availability: High
- CWE: CWE-434 (Unrestricted Upload of File with Dangerous Type)
Technical Details
The vulnerability is an arbitrary file upload issue caused by missing authorization and file type validation in the plugin’s admin_request_handler function. This handler can be reached without authentication because is_admin() may return true for requests to /wp-admin/admin-post.php, allowing unauthenticated requests to invoke the handler.
An attacker able to upload files through this path can place files that may be executable on the server. Where uploaded files are executable and the server executes them, this can lead to remote code execution. The plugin code references (lines in the 3.15 tag) indicate the relevant logic paths in the plugin source.
On Apache servers that honor .htaccess files (AllowOverride enabled), an uploaded .htaccess could prevent direct HTTP retrieval of uploaded files, which reduces exploitability. Stacks that do not honor .htaccess directives—such as nginx, LiteSpeed, or Apache configured with AllowOverride None—remain exposed to direct retrieval and potential execution of uploaded files.
How This Could Impact Your Website
Imagine a small team managing a WordPress site: the site owner, an internal content editor, and an external contractor who uploads assets. An unauthenticated attacker exploiting this vulnerability could upload executable files to the site’s upload directory. Practical consequences include unauthorized execution of code on the server on certain stacks, modification or deletion of site content, or exposure of sensitive data.
Specific risks include the exposure of internal user information such as email addresses if the attacker is able to access files or export data, and an increased risk of targeted phishing or social engineering using that information. The impact depends on server configuration and what uploaded files can do when executed on the hosting stack.
If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level access and accounts you do not recognize.
- Enforce strong passwords and enable two-factor authentication for editor and administrator accounts.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual file uploads, unexpected admin-post.php requests, or other suspicious behavior.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/paid-downloads/tags/3.15/paid-downloads.php#L1036
- https://plugins.trac.wordpress.org/browser/paid-downloads/tags/3.15/paid-downloads.php#L1902
- https://plugins.trac.wordpress.org/browser/paid-downloads/tags/3.15/paid-downloads.php#L79
- https://plugins.trac.wordpress.org/browser/paid-downloads/tags/3.15/paid-downloads.php#L941
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3f0251e5-e575-4662-b81d-72c106e92b50?source=cve
