The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file uploads because file type validation is omitted in download‑add.php. Administrative access allows an attacker to upload any file, potentially including scripts, which could lead to remote code execution on the server. This flaw is classified as CWE‑434 and grants the ability to alter server‑side file contents.

All installations of the WP‑DownloadManager plugin from vendor gamerz, specifically versions 1.68.11 and earlier, are affected. The vulnerability exists in the download‑add.php handling of upload requests.

The vulnerability has a CVSS score of 7.2, an EPSS score below 1%, and is not listed in the CISA KEV catalog. Exploitation requires a user with Administrator‑level privileges; once logged in, the attacker can reach the vulnerable upload endpoint. Because the attack vector is internal and authenticated, the likelihood of exploitation is low but the impact is high, making the risk moderate to high for sites with exposed admin accounts.