Cross-Site Request Forgery Vulnerability in Download Plugins and Themes in ZIP Plugin for WordPress

CVE-2025-14399

What is CVE-2025-14399?

The Download Plugins and Themes in ZIP plugin for WordPress is prone to a Cross-Site Request Forgery vulnerability due to insufficient nonce validation within the download_plugin_bulk and download_theme_bulk functions. This flaw allows attackers to exploit the vulnerability by sending crafted requests that trick site administrators into executing actions without their consent. If successful, the attackers can archive all the site's plugins and themes, potentially compromising the security of the entire WordPress installation. Proper mitigation measures should be adopted to ensure nonce validation is correctly implemented.

References