CVE-2026-87935High· 8.1▾ Twilight

The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the admin_request_handler function

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score45/ 100 · Moderate

impact 44.6 · likelihood 0.2 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Sep 17, 2026

Updated

Sep 19, 2026

CVSS

8.1

Vendor

ichurakov

Product

Paid Downloads

CWE

CWE-434

Depth score

45 · Moderate

EPSS

0.91% · p60

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

decided 2026-09-19

Exploitation: none
Automatable: no
Technical impact: total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Sep 19.

0.5% → 0.9%▲ 0.4%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 8 days

Sep 17, 2026Published
Disclosed via NVD
Sep 19, 2026Record revised
Last analysed / modified upstream
Sep 19, 2026EPSS first tracked
0.5%
Sep 25, 2026EPSS peak
0.5% → 0.9%

ichurakov CWE-434 #nvd #cve.org

Affected

paid_downloads <= 3.15

Full technical detail▾

Overview

The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the admin_request_handler function. This is due to missing authorization and file type validation in the admin_request_handler function, which is reachable unauthenticated via is_admin() returning true for /wp-admin/admin-post.php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. On Apache servers where AllowOverride is enabled, an .htaccess file placed in the upload directory may block direct HTTP retrieval of uploaded files, limiting exploitability to stacks that do not honor .htaccess directives such as nginx, LiteSpeed, and Apache with AllowOverride None.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org

← Back to feed