Arbitrary File Deletion in Download Manager Plugin for WordPress

CVE-2025-3404

What is CVE-2025-3404?

The Download Manager plugin for WordPress is susceptible to an arbitrary file deletion vulnerability due to flawed file path validation within the savePackage function. This affects all versions up to and including 3.3.12. Authenticated users with Author-level access or higher can exploit this weakness to delete arbitrary files on the server. Given that the deletion of critical files such as wp-config.php is possible, this vulnerability poses a significant risk, potentially leading to remote code execution.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References