Local File Inclusion Vulnerability in WP Chill Download Monitor by WordPress
CVE-2025-47439

7.5HIGH

Key Information:

Vendor

WordPress
Status
Download Monitor
Vendor
CVE Published:
7 May 2025

What is CVE-2025-47439?

The WP Chill Download Monitor plugin is susceptible to a Local File Inclusion vulnerability, allowing for the potential inclusion of local files through improper filename controls in PHP code. This security flaw can be exploited by attackers, granting unauthorized access to sensitive files on the server. It specifically impacts versions from n/a through 5.0.22, highlighting the importance of keeping plugins updated to mitigate such risks.

Affected Version(s)

Download Monitor <= 5.0.22

References

https://patchstack.com/database/wordpress/plugin/download...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

João Pedro S Alcântara (Kinorth) (Patchstack Alliance)
.
CVE-2025-47439 : Local File Inclusion Vulnerability in WP Chill Download Monitor by WordPress