The Download Manager plugin permits authenticated users with Author-level or higher privileges to remove any file from the server due to inadequate file path validation in the savePackage routine. An attacker can target critical files such as wp-config.php, enabling remote code execution or complete site compromise. The flaw is a classic Path Traversal issue, classified as CWE-22, and grants destructive capabilities that surpass typical author functions.

WordPress sites running the codename065 Download Manager plugin version 3.3.12 or earlier are affected. This includes the Up to 3.3.12 releases distributed through the official repository and any custom installations that have not been updated to a newer, corrected version.

The CVSS score of 8.8 signals a high severity, while an EPSS score of 2% indicates that exploitation is unlikely but possible. Because the vulnerability requires authenticated access at the author level, threat actors must first compromise or impersonate a legitimate user before deleting files. The flaw is not currently listed in the CISA KEV catalog, but the potential for remote code execution makes it highly critical for organizations that rely on this plugin.