6 matches found
CVE-2026-87935
The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the adminrequesthandler function. This is due to missing authorization and file type validation in the adminrequesthandler function, which is reachable unauthenticated via...
CVE-2026-87935
The Paid Downloads WordPress plugin (versions ≤ 3.15) is vulnerable to an unauthenticated arbitrary file upload via the paiddownloads_update_file action. The root cause is missing authorization and file type validation in the admin_request_handler function, which is reachable without authenticati...
CVE-2026-87935 Paid Downloads <= 3.15 - Unauthenticated Arbitrary File Upload via 'paiddownloads_update_file' Action
The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the adminrequesthandler function. This is due to missing authorization and file type validation in the adminrequesthandler function, which is reachable unauthenticated via...
EUVD-2026-81334
The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the adminrequesthandler function. This is due to missing authorization and file type validation in the adminrequesthandler function, which is reachable unauthenticated via...
CVE-2026-87935 Paid Downloads <= 3.15 - Unauthenticated Arbitrary File Upload via 'paiddownloads_update_file' Action
The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the adminrequesthandler function. This is due to missing authorization and file type validation in the adminrequesthandler function, which is reachable unauthenticated via...
CVE-2026-87935: Unrestricted Upload of File with Dangerous Type
The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the adminrequesthandler function. This is due to missing authorization and file type validation in the adminrequesthandler function, which is reachable unauthenticated via...