Unauthorized Access Vulnerability in Download Manager for WordPress

CVE-2025-13498

What is CVE-2025-13498?

The Download Manager plugin for WordPress contains a vulnerability that enables unauthorized access to sensitive information due to inadequate authorization and capability checks on the wpdm_media_access AJAX action. Authenticated attackers with Subscriber-level access or higher can exploit this flaw to gain access to passwords and access control settings for protected media attachments, allowing them to bypass intended media protections and download restricted files. This vulnerability affects all versions of the plugin up to and including 3.3.32.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References