The WP‑DownloadManager plugin for WordPress allows authenticated administrators to delete any file because it does not limit the target directory. An attacker who logs in with administrator or higher privileges can point the deletion action to critical files such as wp‑config.php, thereby creating a vector for remote code execution if the deleted file is later replaced or the system is otherwise compromised. The vulnerability also relates to CVE‑2025‑4798, which can be used together to delete any file within the WordPress root directory.

The flaw exists in all releases of WP‑DownloadManager up to and including version 1.68.10, a plugin maintained by gamerz for WordPress sites that rely on the WP‑DownloadManager project. All WordPress installations that have this plugin installed and have enabled administrator accounts are affected.

The CVSS score of 7.2 indicates a high risk level, while the EPSS score of 7 % suggests a non‑trivial likelihood of exploitation within the near future. The vulnerability is not yet catalogued in CISA’s KEV list, so it is considered low to moderate exposure according to the KEV database. The exploitation scenario is straightforward: an attacker must have administrator access and simply choose a file path to delete. Because the deletion is not restricted to the plugin’s managed directories, any file under the web server’s root can be removed, leading to potential privilege escalation or arbitrary code execution.