The WP-DownloadManager plugin for WordPress, in all releases up to 1.68.10, allows administrators or higher‑privileged users to read any file on the server. The vulnerability arises because the plugin accepts a target directory for storing downloads without enforcing restrictions, enabling the selection of arbitrary system paths. An attacker who can authenticate as an administrator can therefore download and view sensitive files, such as configuration or system files, leading to confidentiality compromise.

The affected product is WP-DownloadManager, supplied by gamerz, for WordPress. All versions up to and including 1.68.10 are vulnerable. Versions 1.68.11 and newer contain the fix and are not affected.

The CVSS score of 4.9 indicates a moderate impact when an authorized administrator exploits the flaw. The EPSS score of less than 1% reflects a very low likelihood of active exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, suggesting it is not a widely known or actively leveraged threat. The attack vector is inferred to be internal – an attacker must first gain administrator‑level access to the site; once authenticated, the missing directory restriction allows arbitrary file reads.