Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 13 Oct 2026 03:19:07 +0000 CVE-2026-18933 — wp-downloadmanager - Unrestricted File Upload via Missing Extension/MIME Validation and Path Traversal https://cve.radiocsirt.org/vuln/cve-2026-18933 <p><strong>Affected:</strong> wp-downloadmanager</p> <p>The wp-downloadmanager WordPress plugin, in version 1.68.11 (also affecting the 6.9.4 release line), allows an admin-privileged user (current_user_can(&#39;manage_downloads&#39;)) to upload arbitrary files via download-add.php with no extension or MIME-type validation of any kind - no wp_check_filetype_and_ext, no validate_file, and no extension blocklist exist anywhere in the upload handler.</p> <p><strong>Affected:</strong> wp-downloadmanager</p> <p>The wp-downloadmanager WordPress plugin, in version 1.68.11 (also affecting the 6.9.4 release line), allows an admin-privileged user (current_user_can(&#39;manage_downloads&#39;)) to upload arbitrary files via download-add.php with no extension or MIME-type validation of any kind - no wp_check_filetype_and_ext, no validate_file, and no extension blocklist exist anywhere in the upload handler.</p> https://cve.radiocsirt.org/vuln/cve-2026-18933