The vulnerability allows an authenticated administrator to configure the plugin’s download_path parameter with directory traversal sequences that bypass a prefix check, enabling the listing and reading of any file on the server. This constitutes a path traversal flaw (CWE‑22) that can expose sensitive configuration files, credentials, or code, thereby compromising confidentiality and potentially increasing the attack surface for further exploitation. Only users with Administrator level or higher privileges can trigger the flaw, so the attack requires legitimate site access.

The WP‑DownloadManager plugin for WordPress versions up to and including 1.69 is affected; the vendor is gamerz:WP-DownloadManager. All installations of these plugin versions that expose the file browser functionality are vulnerable.

The CVSS score is 2.7, indicating low overall severity, and the EPSS score is less than 1%, reflecting a very low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely to be initiated by an authenticated administrator who modifies the download_path value, exploiting the insufficient validation. While the technical barrier is low for an attacker with admin access, the overall risk remains modest due to the restricted privilege requirement and low exploitation probability.