The Download Plugin for WordPress contains a flaw where the dpwap_plugin_locInstall function does not verify the file type of uploads. An authenticated attacker who has Administrator privileges can place any file onto the site’s file system. If a malicious script is uploaded, the attacker can later execute it, compromising the entire server. This weakness is classified as CWE-434 File Upload through Unvalidated Input.

WordPress sites that use the Download Plugin up to version 2.2.8, published by metagauss. All releases through 2.2.8, inclusive, are affected. No other proprietary software is mentioned.

The incident carries a CVSS score of 7.2, indicating high severity. The EPSS score is below 1 percent, so the likelihood of widespread exploitation is currently low, and the vulnerability has not yet been listed in the CISA KEV catalogue. Attackers would need to be authenticated as an Administrator level user and then leverage the upload form within the plugin’s administrative interface. Because the flaw permits direct file placement, a successfully leveraged upload could lead to remote code execution.