Police said there was no reason to suspect that the blast, on the eve of Fourth of July celebrations, was the work of extremists or that the explosive object had been designed to hurt anyone.
Investigators said the object was likely fabricated by an amateur fireworks enthusiast for the thrill of creating a loud noise and flash. At least one bystander in the park told CNN the blast sounded "like a cannon."
Photographs of the injured man, who police said was visiting from Virginia with two friends, showed his left foot bandaged and badly mangled as he was being treated by emergency medical technicians on the scene.
The man was taken to Bellevue Hospital, where police said he was undergoing surgery and was listed in serious but stable condition. His two companions, aged 18 and 20, were not injured. None was believed to have had anything to do with making the device.
The late-morning explosion occurred when all three men jumped off a rock and the victim landed on top of the object, which had been stashed near the boulder out of the way of normal foot traffic, police said.
"At this time, we have no evidence this is related to terrorism," NYPD Deputy Chief John O'Connell told reporters in the park, adding there were "no specific credible threats directed at New York or the July Fourth celebrations."
Lieutenant Mark Torre, commander of the police bomb squad, said there was nothing to indicate the device was "put in this area with a specific intent to harm any individual" and that evidence showed it was not meant to be detonated by someone stepping on it.
He said the device, which was believed to have been in the park for at least a day, "may have not gone off at an earlier time and was just left there."
The 778-acre (315-hectare) park in the heart of Manhattan is a major draw for tourists visiting New York City. The park remained open to visitors following the blast.
But police were checking for any additional explosives in the park, using dogs trained to detect vapor trails left behind by explosives or would-be bombers.
Teams of so-called Vapor Wake Detection dogs were being deployed in New York for the first time as part of stepped-up measures to protect America's most populous city during the holiday weekend.
The enhanced security comes amid heightened U.S. vigilance against potential assaults on public places following deadly attacks during the past week on a Bangladesh cafe, claimed by Islamic State, and at Istanbul's main airport blamed on the militant group.