WordPress 媒体库下载器插件 <= 1.4.0 - 跨站请求伪造 (CSRF) 漏洞

The CSRF vulnerability in Media Library Downloader allows attackers to leverage authenticated user sessions to execute malicious actions. An attacker could craft a malicious link or embed a hidden form on a website they control. When a user with an active Media Library Downloader session visits this malicious page, the attacker's code will be executed with the user's privileges. This could result in the attacker deleting media files, modifying settings, or performing other actions as if they were the legitimate user. The blast radius is limited to the scope of actions available within the Media Library Downloader plugin, but the impact can be significant for users who rely on the plugin for managing their media assets.

WordPress websites utilizing the Media Library Downloader plugin, particularly those with shared hosting environments or where user access controls are not strictly enforced, are at increased risk. Users who frequently manage media files through the plugin's interface are also more vulnerable.

• wordpress / composer / npm:

grep -r 'wp_query_vars' /var/www/html/wp-content/plugins/media-library-downloader/

• generic web:

curl -I https://your-wordpress-site.com/wp-admin/admin-ajax.php?action=media_library_downloader_delete_file | grep -i 'referer'

1. 2025-12-09Disclosure

   disclosure

1. 已保留2025-10-21
2. 发布日期2025-12-09
3. 修改日期2026-04-28
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2025-62734 is to upgrade to a patched version of Media Library Downloader as soon as it becomes available. Until a patch is released, consider implementing temporary workarounds. One approach is to restrict access to sensitive Media Library Downloader functions using WordPress's built-in capabilities or custom code to require additional authentication steps. Implementing a Content Security Policy (CSP) can also help mitigate CSRF attacks by restricting the sources from which scripts can be executed. Monitor WordPress access logs for suspicious requests targeting Media Library Downloader endpoints.

活跃安装数

3K小众

插件评分

4.7

需要WordPress版本

5.0+

兼容至

6.8.5

需要PHP版本

5.6+