The WP File Download plugin for WordPress is affected by a directory traversal flaw in the remoteurl parameter that allows an attacker who is already authenticated with a Subscriber role or higher to read the contents of any file on the server. The vulnerable code processes the remoteurl value without proper validation, enabling traversal of the file system and exposure of potentially sensitive server files. This flaw is identified as CWE-22.

All installations of JoomUnited WP File Download up to and including version 6.3.8 are vulnerable. The flaw resides in the plugin’s handling of the _wpfd_file_metadata array and the streaming endpoint that is invoked via the WordPress init hook.

The CVSS score is 6.5, indicating a moderate severity and a medium likelihood of exploitation. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the malicious request requires only subscriber‑level authentication to poison the metadata followed by an unauthenticated request to the streaming endpoint, an attacker with minimal privileges can achieve the file read. The path traversal can target any file on the server that the web process can read, potentially revealing credentials, configuration files or other sensitive data.