CVE-2026-2426

The WP-DownloadManager plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.69 via the 'file' parameter in the file deletion functionality. This is due to insufficient validation of user-supplied file paths, allowing directory traversal sequences. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can lead to remote code execution when critical files like wp-config.php are deleted.

• CWE-22

• https://github.com/lesterchan/wp-downloadmanager/commit/d3470a8971d9043438c8aad281cf37d14fefa208
• https://plugins.trac.wordpress.org/browser/wp-downloadmanager/tags/1.69/download-manager.php#L215
• https://plugins.trac.wordpress.org/browser/wp-downloadmanager/trunk/download-manager.php#L215
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a3f791dd-7c24-45e3-b4f6-b8d7e594c568?source=cve

Published

Feb 18, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-24251NVIDIA Megatron Bridge for Linux contains a vulnerability wh…7.8
• CVE-2026-24252NVIDIA NeMo for Linux contains a vulnerability where an atta…7.8
• CVE-2026-24253NVIDIA Dynamo for Linux contains a vulnerability where an at…8.2
• CVE-2026-24254NVIDIA Dynamo for Linux contains a vulnerability in the mult…9.8
• CVE-2026-24255NVIDIA Dynamo for Linux contains a vulnerability in the mult…7.5
• CVE-2026-24259NVIDIA TensorRT-LLM for Linux contains a vulnerability where…6.4
• CVE-2026-24260NVIDIA Container Toolkit for Linux contains a vulnerability …8.5
• CVE-2026-24264NVIDIA Triton Inference Server for Linux contains a vulnerab…7.5
• CVE-2026-24266NVIDIA Triton Inference Server for Linux contains a vulnerab…7.5
• CVE-2026-24268NVIDIA TensorRT contains a vulnerability where an attacker m…7.8
• CVE-2026-2427The itsukaita plugin for WordPress is vulnerable to Reflecte…6.1
• CVE-2026-24270NVIDIA AIStore framework contains a vulnerability where an a…9.8