WP Download Manager Plugin for WordPress contains a flaw that allows a remote attacker to execute arbitrary PHP code. This flaw exists because the wpdm_ajax_call_exec() function in the /trunk/wpdm-core.php script does not properly verify or sanitize user-uploaded files when handling ajax requests. By uploading a .php file, the remote system will place the file in a user-accessible path. Making a direct request to the uploaded file will allow the attacker to execute the script with the privileges of the web …