The Download Manager plugin for WordPress allows authenticated users with Author role or higher to exploit a directory traversal flaw via the 'wpdm_newfile' action. This flaw permits overwriting of select file types located in directories outside the intended plugin directory. The vulnerability could result in denial of service by corrupting or replacing critical files such as configuration or template files, though the scope is limited to specific file types and does not provide arbitrary code execution.

The affected system is the Download Manager plugin by codename065, available as a free WordPress plugin. Versions up to and including 3.3.08 contain the vulnerability. The plugin is commonly installed on WordPress sites where it provides file‑management functionality.

The CVSS score of 5.4 indicates moderate risk, while an EPSS score of less than 1% signals a low probability of exploitation. The issue is not listed in the CISA KEV catalog, suggesting it is not a widely leveraged, known exploit. The attack vector is inferred to be an authenticated user with Author or higher privileges; the vulnerability requires knowledge of the internal file paths and acceptable file types. No public exploits or evidence of active compromise have been reported.