THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-87935 (HIGH 8.1) — The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the admin_request_handler function. This is due to missing authorization and file type validation in the admin_request_handler function, which is reachabl

[NVD] CVE-2026-87935 (HIGH 8.1) — The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the admin_request_handler function. This is due to missing authorization and file type validation in the admin_request_handler function, which is reachabl

mednvdPublished 2026-09-17

CVE-2026-87935 CVSS: 8.1 HIGH Published: 2026-09-17T05:17:02.263

The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the admin_request_handler function. This is due to missing authorization and file type validation in the admin_request_handler function, which is reachable unauthenticated via is_admin() returning true for /w

Indicators of compromise

CVE-2026-87935cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-87935