Privilege Escalation Vulnerability in Download Manager Plugin for WordPress

CVE-2025-15364

What is CVE-2025-15364?

The Download Manager plugin for WordPress contains a vulnerability that allows unauthenticated attackers to execute a privilege escalation attack. This is initiated by exploiting inadequate identity verification when users attempt to update their account details, including passwords, in versions up to and including 3.3.40. By successfully performing this attack, adversaries can change user passwords (excluding administrators) and take control over user accounts, posing a significant security risk.

References