The WP-DownloadManager plugin for WordPress contains a path traversal flaw in the file deletion functionality. A user can supply directory traversal sequences in the 'file' parameter, bypassing the plugin's validation. This allows an attacker with Administrator-level access to delete any file on the server, including critical files such as wp-config.php, which can result in remote code execution if the site integrities are compromised.

WordPress sites running the WP-DownloadManager plugin version 1.69 or earlier from the Vendor gamerz are affected. Any installation that has not yet upgraded past this version is vulnerable.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated Administrator access to the WordPress dashboard and the ability to supply a crafted file path to the deletion endpoint; there are no known publicly available exploits at this time.