Lana Downloads Manager WordPress Plugin Path Traversal Vulnerability Allowing Arbitrary File Download

A path traversal vulnerability has been identified in the Lana Downloads Manager WordPress plugin, affecting versions prior to 1.10.0. The vulnerability arises because the plugin fails to properly validate user input used in file paths. This flaw could enable users with admin roles to exploit path traversal techniques and download arbitrary files from the server.

Impact

Exploitation of this vulnerability could lead to unauthorized access and download of sensitive files from the server.

Remediation

Users are advised to update the Lana Downloads Manager WordPress plugin to version 1.10.0 or later.