Arbitrary File Deletion in Download Manager Plugin for WordPress

CVE-2025-3404

What is CVE-2025-3404?

The Download Manager plugin for WordPress is susceptible to an arbitrary file deletion vulnerability due to flawed file path validation within the savePackage function. This affects all versions up to and including 3.3.12. Authenticated users with Author-level access or higher can exploit this weakness to delete arbitrary files on the server. Given that the deletion of critical files such as wp-config.php is possible, this vulnerability poses a significant risk, potentially leading to remote code execution.

References