Download Manager <= 3.3.12 - Authenticated (Author+) Willkürliches Löschen von Dateien

The primary impact of CVE-2025-3404 is the potential for remote code execution. By deleting critical files, an attacker can gain control of the WordPress site and potentially the underlying server. The vulnerability stems from insufficient file path validation within the savePackage function. An attacker can craft a malicious request to specify a file path outside of the intended directory, leading to its deletion. Deleting wp-config.php is a particularly dangerous scenario, as it contains sensitive database credentials and configuration settings, allowing the attacker to completely compromise the site. This vulnerability shares similarities with other file deletion vulnerabilities where improper input validation allows attackers to bypass security controls.

WordPress sites utilizing the Download Manager plugin, particularly those with multiple users having Author or higher roles, are at significant risk. Shared hosting environments where users have elevated privileges are also particularly vulnerable, as an attacker could potentially compromise the entire hosting account.

• wordpress / composer / npm:

grep -r 'savePackage' /var/www/html/wp-content/plugins/download-manager/

• generic web:

curl -I 'http://your-wordpress-site.com/wp-content/plugins/download-manager/savePackage.php?file=../../../../wp-config.php' # Attempt to access wp-config.php

• wordpress / composer / npm:

wp plugin list --status=inactive | grep 'download-manager'

• wordpress / composer / npm:

wp plugin list --status=active | grep 'download-manager'

1. 2025-04-19Disclosure

   disclosure

1. Reserviert2025-04-07
2. Veröffentlicht2025-04-19
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-3404 is to upgrade the WordPress Download Manager plugin to a version that addresses the vulnerability. The vendor has not yet released a fixed version, so immediate action is required. As a temporary workaround, restrict file upload permissions for users with Author-level access or higher. Implement a Web Application Firewall (WAF) rule to block requests containing suspicious file paths or attempts to access sensitive files. Carefully review and audit all file upload and modification processes within the plugin to identify and address any potential vulnerabilities. After upgrading, verify the fix by attempting to delete a non-critical file using a crafted request and confirming that the deletion is prevented.

Aktive Installationen

100KBekannt

Plugin-Bewertung