The wp-downloadmanager WordPress plugin, version 1.68.11 (and the 6.9.4 release line), allows an admin‑privileged user (current_user_can('manage_downloads')) to upload arbitrary files via download‑add.php without any extension or MIME‑type validation—no wp_check_filetype_and_ext or validate_file is invoked, and no extension blocklist exists. Based on the description, an attacker could upload an executable file such as PHP, place it in a publicly accessible location, and potentially execute code on the server, which could compromise configuration, data, and overall system integrity.

WordPress sites that use the wp-downloadmanager plugin in version 1.68.11 or any release that includes that version, including the 6.9.4 release line, are affected. The flaw exists only when an administrator accesses the download‑add.php handler; other user roles or plugin versions are not vulnerable.

The CVSS score of 7.2 indicates high severity, while the EPSS score of less than 1 % indicates a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An attacker must first possess administrator privileges to the plugin, which typically limits access to trusted site owners or administrators. Once authenticated, the flaw can be exploited immediately to upload and execute arbitrary code, raising the risk to all users of the affected site.