Privilege Escalation Vulnerability in Download Manager Plugin for WordPress
CVE-2025-15364
7.3HIGH
What is CVE-2025-15364?
The Download Manager plugin for WordPress contains a vulnerability that allows unauthenticated attackers to execute a privilege escalation attack. This is initiated by exploiting inadequate identity verification when users attempt to update their account details, including passwords, in versions up to and including 3.3.40. By successfully performing this attack, adversaries can change user passwords (excluding administrators) and take control over user accounts, posing a significant security risk.
Affected Version(s)
Download Manager * <= 3.3.40
References
CVSS V3.1
Score:
7.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Drew Webber