Unauthorized Data Modification in Simple Downloads List Plugin for WordPress
CVE-2025-12583

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Simple Downloads List
Vendor
CVE Published:
8 November 2025

What is CVE-2025-12583?

The Simple Downloads List plugin for WordPress is exposed to a significant vulnerability due to the lack of necessary capability checks on its 'wp_ajax_neofix_sdl_edit' AJAX endpoint. This flaw enables authenticated users with Subscriber-level access or higher to modify various settings, manage downloads, and potentially inject harmful web scripts. The vulnerability exists across all versions up to and including 1.4.3, posing a risk to websites utilizing this plugin.

Affected Version(s)

Simple Downloads List * <= 1.4.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/simple-downloa...
https://plugins.trac.wordpress.org/changeset?old_path=/si...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Md. Moniruzzaman Prodhan
JSON
.
CVE-2025-12583 : Unauthorized Data Modification in Simple Downloads List Plugin for WordPress