Green Downloads Arbitrary File Upload Vulnerability

Plugin Name	Green Downloads
Type of Vulnerability	Arbitrary File Upload
CVE Number	CVE-2026-32536
Urgency	High
CVE Publish Date	2026-03-22
Source URL	CVE-2026-32536

Urgent Security Advisory: Arbitrary File Upload in Green Downloads (WordPress plugin) — What Site Owners Must Do Now

On 20 March 2026 a high-severity arbitrary file upload vulnerability affecting the Green Downloads WordPress plugin (versions <= 2.08) was disclosed and assigned CVE-2026-32536. The vulnerability allows an attacker with limited privileges to upload arbitrary files to a site and — in many real-world configurations — to execute them. The reported CVSS score is 9.9 and the vendor published a patch in version 2.09. If you run this plugin on any site, treat this as a production-critical issue: read this advisory, follow the immediate steps below, and harden your site to prevent follow-on compromise.

This article is written from the perspective of WP-Firewall — a WordPress security team and managed WAF provider — and is intended for WordPress site owners, administrators, developers and hosting teams. I’ll explain the technical root cause in practical terms, walk through realistic attack scenarios, show how to detect exploitation, and provide prioritized remediation, mitigation and hardening instructions you can follow immediately.

Note: if you manage multiple sites, triage and prioritize by exposure (public facing downloads, low-privileged registration possibilities, sites with multiple users). Treat all sites running Green Downloads <= 2.08 as potentially vulnerable until patched.

---

Executive summary (TL;DR)

• A high-severity arbitrary file upload vulnerability exists in Green Downloads plugin versions <= 2.08 (CVE-2026-32536).
• Attackers with a Subscriber-level account (or equivalent) can upload files that may be executed on the web host.
• Impact: remote code execution, persistent backdoors, data theft, SEO spam, cryptomining, site defacement and lateral movement.
• Immediate actions: update plugin to 2.09 (patched version). If you cannot update immediately, disable the plugin, restrict file uploads at the webserver/WAF level, and run a comprehensive scan.
• WP-Firewall customers: we have mitigation rules that block the known exploit patterns and can provide virtual patching while you update.
• Longer term: apply hardening, file integrity monitoring, least-privilege controls and continuous WAF protections.

---

What is “arbitrary file upload” and why is it so dangerous?

An arbitrary file upload vulnerability lets an attacker place files of their choosing onto your webserver (for example PHP files, scripts, or files that otherwise bypass type checks). On typical WordPress hosts, uploaded PHP files inside web-accessible directories can be invoked directly by a browser and execute server-side code. That means an attacker can:

• Upload web shells for persistent access
• Run arbitrary PHP (leading to full site compromise)
• Modify or exfiltrate database contents or private files
• Establish additional backdoors and scheduled tasks (cron)
• Use the server as a platform for attacks (SEO spam, phishing, cryptomining)
• Move laterally to other sites or services hosted on the same infrastructure

Because uploads can be automated, mass-campaigns leverage such vulnerabilities to rapidly compromise thousands of sites. That’s why CVSS is high and why immediate mitigation is required.

---

Technical root cause (in plain language)

Although each plugin implements file upload endpoints differently, arbitrary upload issues usually stem from one or more of the following design mistakes:

• Missing or weak authorization checks: plugin functions accept uploads from roles that shouldn’t be able to upload executable files (the report indicates Subscriber-level privileges are sufficient).
• Inadequate server-side validation: the plugin trusts client-provided content-type or file extension rather than enforcing strict server-side verification.
• Use of direct filesystem operations without sanitization: files are moved into web-accessible directories without checking content (magic bytes), extensions, or names; double-extension patterns (e.g., image.php.jpg) may be mishandled.
• Failure to enforce safe upload directories: files are placed into directories where PHP execution is allowed.
• Insecure use of WordPress APIs: incorrect or absent use of functions like wp_handle_upload(), capability checks, nonce verification, or sanitization functions.

An attacker leverages these failures to upload a malicious payload (often a tiny PHP web shell), then accesses it through HTTP to execute arbitrary commands or PHP code.

---

Realistic attack flow

1. Attacker registers an account or finds a Subscriber account on the site (or abuses an existing subscriber-level account).
2. Attacker navigates to the plugin’s upload endpoint (often a form or AJAX endpoint intended for assets).
3. Using an HTTP client (browser tools, curl, scripts) the attacker submits a multipart/form-data POST containing a file named to bypass naive extension checks (e.g., shell.php.jpg or shell.php with a spoofed content-type).
4. The plugin accepts the file and writes it into a web-accessible folder (for example /wp-content/uploads/ or a plugin subfolder) without validating the file’s internal content.
5. Attacker visits uploaded-file URL (e.g., https://example.com/wp-content/uploads/malicious.php) and executes code.
6. From the web shell the attacker uploads further tools, creates admin accounts, exfiltrates data, modifies content and persists.

Many attackers will also run automated searches for vulnerable endpoints and use the same payload across many sites, enabling mass compromise.

---

Indicators of compromise (IOCs) to check right now

Search your site and access logs for signs of suspicious uploads and remote execution:

• Recently added files in uploads or plugin directories with unusual file extensions:
  • Files named like: shell.php, uploader.php, wp-update.php, .php5, .phtml, anything with .php embedded (shell.php.jpg)
• New files with random names and short lifespan (deleted soon after).
• 200 responses to multipart/form-data to plugin endpoints (POST requests to plugin-specific paths).
• Requests to uploaded files immediately after upload (indicates testing/execution).
• New administrative or editor users you didn’t create.
• Unexpected scheduled tasks (wp-cron events) created by unknown users.
• Obfuscated JavaScript in posts or unexpected SEO content/warnings.
• High CPU usage, unexpected processes, or external connections from your server (common with cryptomining).
• Modified plugin files or WordPress core files with recent timestamps.

Useful commands (run from the server shell) to look for suspicious PHP files in uploads:

• Find PHP files created in the last 7 days:

  find wp-content/uploads -type f -mtime -7 -iname "*.php"

• Search for eval and base64_decode in uploads:

  grep -R --line-number --exclude-dir=cache -E "eval\(|base64_decode\(" wp-content/uploads || true

• List files with php as part of the filename:

  find . -type f -regex ".*php.*" -print

If you find anything suspicious, do not delete until you have a backup and a scanned copy (investigation often requires keeping forensic evidence). Consider taking the site offline or serving a maintenance page while investigating.

---

Immediate remediation steps (priority order)

1. Update Green Downloads to version 2.09 RIGHT NOW (the vendor patched this release). This is the single most important step.
2. If you cannot update immediately:
   • Deactivate the plugin on all affected sites.
   • If you cannot deactivate, restrict access to the plugin upload endpoints at the webserver/WAF level (block POSTs to specific plugin paths).
3. Rotate credentials:
   • Reset all WordPress administrator and user passwords (especially users with elevated privileges).
   • Rotate database credentials and API keys stored in wp-config.php if you suspect server access.
4. Perform a full site scan:
   • Use a trusted malware scanner and check server filesystem for web shells and suspicious files (see IOCs above).
5. Audit users and roles:
   • Remove unknown users and validate roles. Ensure only trusted personnel have admin/editor permissions.
6. Restore from a clean backup:
   • If you confirm compromise, restore from a known-good backup taken before the vulnerability disclosure. After restoration, update plugins, harden, and monitor.
7. Check server logs and forensic data:
   • Review access logs for exploit attempts, IPs, and times. Preserve logs for reporting and further investigation.
8. If compromise is suspected, consider professional incident response (host provider or security specialists).

---

Containment and mitigation while you patch

If immediate plugin updates aren’t possible, apply these mitigations to reduce risk:

• Apply WAF rules that block the exploit patterns (WP-Firewall customers are protected by virtual patching; if you use another WAF, implement blocking rules immediately).
• Block HTTP POST requests to the plugin’s AJAX/upload endpoint(s).
• Block multipart/form-data requests containing PHP in filenames or suspicious content types.
• Restrict the plugin’s upload directory so PHP cannot execute:
  • For Apache: add an .htaccess in the upload path to disable PHP execution:

    <FilesMatch "\.php$">
    Deny from all
    </FilesMatch>

  • For nginx: deny execution of PHP files in uploads by adjusting location rules to return 404 for .php files in upload directories.
  • If your host supports it, mark the plugin directory as non-executable for PHP.
  • Implement temporary IP access control: restrict access to the site backend (wp-admin) to admin IP addresses where feasible.

These steps reduce immediate risk and buy time to update and perform cleanup.

---

How a WAF (Web Application Firewall) should mitigate this issue

At WP-Firewall we use a layered approach:

1. Signature-based detection
   • Block known exploit request patterns (e.g., multipart requests with suspicious filename patterns or payloads). Example of a signature pattern:
     • Block POSTs to /wp-content/plugins/green-downloads/.* (or plugin-specific upload endpoint) that include filename with “.php” or double extension patterns like .php.jpg.
2. Content inspection
   • Verify file magic bytes vs. extension. If a file declares image/jpeg but contains PHP opening tags, block it.
3. Behavioral rules
   • Throttle or block repeated attempts from the same IP or IP-range exhibiting exploit activity.
4. Virtual patching
   • Apply rules to block the vulnerable code path entirely until plugin is updated.
5. Contextual enforcement
   • Enforce capability checks: if an endpoint is designed for authenticated editors only, block unauthenticated or low-privilege requests.
6. Logging and alerting
   • Generate alerts for blocked attempts and correlate across sites.

Below are example (conceptual) WAF rules you can implement — adapt to your WAF engine (ModSecurity, Nginx WAF, Cloud WAF consoles). These are illustrative patterns; test in a staging environment before deploying in production.

Example ModSecurity-style rule (conceptual):

# Block POST file uploads to specific plugin upload path containing .php
SecRule REQUEST_METHOD "POST" "chain,phase:2,deny,status:403,msg:'Block potential Green Downloads arbitrary upload exploit'"
  SecRule REQUEST_URI "@rx /wp-content/plugins/green-downloads/.*(upload|ajax).*" "chain"
  SecRule &MULTIPART_PART_HEADERS_NAMES "@greaterThan 0" "chain"
  SecRule FILES_TMPNAMES|FILES_NAMES "@rx \.php($|\.|%2e)" "t:none"

Example Nginx (conceptual) to deny access to PHP in uploads:

location ~* /wp-content/uploads/.*\.(php|phtml|php5)$ {
    return 403;
}

Important: these examples are intentionally generic. You must adapt to your environment and test thoroughly.

---

Detection: logging, queries and proactive hunts

• Search webserver logs for POSTs to the plugin paths and file uploads:

  grep "POST .*green-downloads" /var/log/apache2/access.log

• Look for user-agent patterns or repeated requests with different filenames from same IP.
• Track changes to filesystem:
  • Use File Integrity Monitoring to alert on new or modified PHP files in uploads and plugin directories.
• Use WP-CLI to list recent plugin updates and file modifications:

  wp plugin list --update=available
  wp core verify-checksums

• Schedule regular malware scans after patching to ensure no dormant backdoors remain.

---

Cleanup and recovery if you are compromised

If analysis shows the site was exploited:

1. Isolate the site: put it in maintenance mode or disconnect from the network if possible.
2. Collect evidence: preserve logs, copies of suspicious files and timestamps.
3. Rebuild cleanly if possible:
   • Restore from an uncompromised backup. Do not reintroduce the same vulnerability.
   • If no clean backup exists, rebuild WordPress and reinstall plugins/themes from original sources, then migrate content and the sanitized database.
4. Remove backdoors:
   • Search for web shells, rogue PHP files, base64 eval, and remove them after documentation.
5. Rotate all secrets:
   • WordPress user passwords, database credentials, SSH keys, API tokens.
6. Patch:
   • Update WordPress core, all plugins and themes (especially Green Downloads to 2.09+).
7. Harden:
   • Disable file editing via define('DISALLOW_FILE_EDIT', true);
   • Restrict PHP execution in uploads and cache directories.
   • Enforce least privilege for users.
8. Monitor:
   • Intensify logging for 30 days, watch for signs of detection evasion or reinfection.
9. Notify stakeholders:
   • If data breach is suspected (personal data exposure), follow regulatory notification requirements for your jurisdiction and inform hosting provider.

If you’re not confident in fully cleaning the incident, engage a specialist or your hosting security team.

---

Prevention: longer-term hardening recommendations

Make these changes standard practice across your WordPress estate:

• Keep everything up to date: WordPress core, plugins, themes.
• Remove unused plugins/themes — they are attack surface.
• Enforce principle of least privilege:
  • Review users quarterly. Subscriber is a low-level role — still, any role with upload access can be exploited if a plugin permits it.
• Disable PHP execution in uploads and other content directories.
• Use a reliable WAF with virtual patching to block public exploit vectors immediately on disclosure.
• Use file integrity monitoring and malware scanning with alerting.
• Harden wp-config.php: move it to non-web-root if possible, and use strict file permissions.
• Use two-factor authentication for admin users and strong password policies.
• Protect admin pages: restrict /wp-admin and /wp-login.php by IP where possible.
• Review and sanitize any third-party code that handles file uploads or accepts user content.
• Maintain regular backups and test restores: you should be able to restore within your RTO.
• Automate updates where feasible, but review before enabling auto-update on critical production sites.

---

Example “hunt” queries and commands

• Find new PHP files in plugin and uploads directories:

  find /var/www/html/wp-content/uploads -type f -name '*.php' -print
  find /var/www/html/wp-content/plugins -type f -mtime -7 -print

• Search for common webshell patterns:

  grep -R --exclude-dir=node_modules -E "(base64_decode|eval\(|assert\(|system\(|passthru\(|shell_exec\()" /var/www/html

• Detect unusual outbound connections (Linux):

  netstat -plant | grep -v ESTABLISHED

• WP-CLI to list users:

  wp user list --role=administrator

---

What WP-Firewall recommends and provides

As a WordPress security provider, WP-Firewall recommends the following immediate program:

1. Patch first — update Green Downloads to version 2.09 immediately on all affected sites.
2. Enable protection from a WAF that provides virtual patching and content inspection — virtual patches after disclosure stop the exploitation vector even before you can apply the plugin update.
3. Use continuous scanning and file integrity monitoring to detect any signs of exploitation.
4. Implement the containment measures above (block POSTs to plugin endpoints, disable PHP execution in uploads).
5. If compromised, follow the recovery steps above and consider professional remediation.

WP-Firewall provides layered protections that align with these recommendations: managed WAF rules, malware scanning, virtual patching and monitoring. Our engineering team maps the exploit patterns and supplies tailored rules to customers to reduce exposure while they perform the required updates and cleanup.

---

Why WP-Firewall’s Free Tier Helps Immediately

Why WP-Firewall’s Free Tier Is Your First Line of Defense

If you manage any WordPress site and want to protect it quickly, WP-Firewall’s Basic (Free) plan gives you the essentials you’ll need to reduce risk right now. The free plan includes a managed firewall, unlimited bandwidth, WAF protections, a malware scanner and mitigation for OWASP Top 10 risks. That means even on the free tier we can apply blocking rules for known exploit patterns (like the Green Downloads upload vector) and scan your files for suspicious additions. Get protected immediately by signing up here: https://my.wp-firewall.com/buy/wp-firewall-free-plan/

(If you need more automation, our Standard and Pro plans add automatic malware removal, IP blacklist/whitelisting, scheduled security reports, and advanced virtual patching with premium add-ons.)

---

Practical checklist: what to do in the next 24–72 hours

• Next 1 hour:
  • Check if Green Downloads plugin is installed anywhere in your environment.
  • If yes, update to 2.09 immediately; if you can’t update, deactivate the plugin.
  • Enable or deploy a WAF rule that blocks uploads to the plugin’s endpoints.
• Next 24 hours:
  • Run a full malware/file scan across the site(s).
  • Search for the IOCs described above and preserve logs.
  • Rotate admin and critical credentials.
• Next 72 hours:
  • Complete restore/cleanup where compromise occurred.
  • Harden file permissions and disable PHP execution in uploads.
  • Enable continuous monitoring and file integrity checks.
  • Enroll your site in a managed WAF or virtual patching service if you haven’t already.

---

On reporting and disclosure etiquette

If you find evidence of exploitation, preserve logs and follow responsible disclosure to the plugin author or the plugin marketplace where it is distributed. If you are a researcher, use the vendor’s responsible disclosure channels. Site owners under attack should contact their host and incident response professionals. If you are a WP-Firewall customer, contact our support team with your site details and we will prioritize investigation and virtual patching.

---

Final words — don’t wait

Arbitrary file upload vulnerabilities are among the fastest to turn into full site compromise. The combination of low required privileges and the ability to execute server-side code makes them extremely valuable to attackers. The correct immediate action is straightforward: update Green Downloads to 2.09, apply webserver/WAF mitigations if you cannot update right away, and scan for signs of compromise.

If you want an immediate protective layer while you update and investigate, WP-Firewall’s managed WAF and standard protections can be enabled quickly (including a free tier that covers basic mitigation and scanning). Sign up and let us help put a protective layer around your WordPress site: https://my.wp-firewall.com/buy/wp-firewall-free-plan/

If you need help triaging a suspected compromise, our incident response team can advise on next steps and help clean infected sites. Stay vigilant — attackers will try to exploit this disclosure quickly.

---

Appendix: quick reference

• Affected software: Green Downloads (WordPress plugin) <= 2.08
• Patched version: 2.09
• CVE: CVE-2026-32536
• Severity: High / CVSS 9.9
• Required privilege: Subscriber (low-privilege user)
• Immediate fix: Update to 2.09 (or deactivate plugin)
• Short-term mitigations: WAF rules, block POST to plugin endpoints, disable PHP execution in uploads
• Long-term: keep core/plugins updated, use WAF with virtual patching, file integrity monitoring, least privilege, backups and test restores

If you need a prioritized remediation plan tailored to your site(s), WP-Firewall’s support team can help you triage and implement the steps above.