The Download Manager plugin permits authenticated users with Author-level or higher privileges to remove any file from the server due to inadequate file path validation in the savePackage routine. An attacker can target critical files such as wp-config.php, enabling remote code execution or complete site compromise. The flaw is a classic Path Traversal issue, classified as CWE-22, and grants destructive capabilities that surpass typical author functions.

WordPress sites running the codename065 Download Manager plugin version 3.3.12 or earlier are affected. This includes the Up to 3.3.12 releases distributed through the official repository and any custom installations that have not been updated to a newer, corrected version.

The CVSS score of 8.8 signals a high severity, while an EPSS score of <1% indicates that exploitation is unlikely but possible. Based on the description, it is inferred that threat actors must first acquire authenticated access at the author level, typically by compromising or impersonating a legitimate user, before deleting files. The flaw is not currently listed in the CISA KEV catalog, but the potential for remote code execution makes it highly critical for organizations that rely on this plugin.