Privilege Escalation Vulnerability in Download Manager Plugin for WordPress

CVE-2025-15364

What is CVE-2025-15364?

The Download Manager plugin for WordPress contains a vulnerability that allows unauthenticated attackers to execute a privilege escalation attack. This is initiated by exploiting inadequate identity verification when users attempt to update their account details, including passwords, in versions up to and including 3.3.40. By successfully performing this attack, adversaries can change user passwords (excluding administrators) and take control over user accounts, posing a significant security risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References