Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-87935— Paid Downloads <= 3.15 - Unauthenticated Arbitrary File Upload via 'paiddownloads_update_file' Action

Quick assessment

Affected
ichurakov Paid Downloads
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 Paid Downloads 插件在 3.15 及更早的所有版本中均存在任意文件上传漏洞，漏洞位于 函数中。该漏洞是由于 函数缺少身份验证和文件类型校验所致，且该函数在未认证的情况下可通过 对 返回 true 而被访问。这使得未认证的远程攻击者能够上传可执行文件，从而可能导致远程代码执行（RCE）。 在启用了 的 Apache 服务器上，若将 文件放置在上传目录中，可能会阻止对上传文件的直接 HTTP 访问，从而限制漏洞的利用范围。因此，该漏洞主要影响不遵守 指令的环境，例如 nginx、L

CVSS 8.1 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-87935

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Paid Downloads <= 3.15 - Unauthenticated Arbitrary File Upload via 'paiddownloads_update_file' Action
Source: CVE Program / CVE List V5
Vulnerability Description
The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the admin_request_handler function. This is due to missing authorization and file type validation in the admin_request_handler function, which is reachable unauthenticated via is_admin() returning true for /wp-admin/admin-post.php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. On Apache servers where AllowOverride is enabled, an .htaccess file placed in the upload directory may block direct HTTP retrieval of uploaded files, limiting exploitability to stacks that do not honor .htaccess directives such as nginx, LiteSpeed, and Apache with AllowOverride None.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
危险类型文件的不加限制上传
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
ichurakov Paid Downloads 0 ~ 3.15 -

II. Public POCs for CVE-2026-87935

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-87935

请登录查看更多情报信息。

Vendor Pages for CVE-2026-87935 (1)

Other References for CVE-2026-87935 (4)

IV. Related Vulnerabilities

Same product: Paid Downloads
Same vendor: ichurakov
Same weakness: CWE-434

V. Comments for CVE-2026-87935

No comments yet

Leave a comment