CVE-2022-2431

The Download Manager plugin for WordPress through version 3.2.50 contains an arbitrary file deletion vulnerability in the deleteFiles() function within the Packages.php file. When a download post is deleted, the function fails to properly validate file paths and types, allowing contributors and higher-level users to delete arbitrary files by supplying a malicious path through the file[files] parameter. Attackers could exploit this to remove critical files like wp-config.php, effectively resetting the WordPress installation and enabling remote code execution.

Based on public CVE data (MITRE/NVD).