CVE-2025-3404: Download Manager <= 3.3.12 - Authenticated (Author+) Arbitrary File Deletion
The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the savePackage function in all versions up to, and including, 3.3.12. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3404?
CVE-2025-3404 has a moderate severity rating due to its potential for arbitrary file deletion.
How do I fix CVE-2025-3404?
To fix CVE-2025-3404, upgrade the WordPress Download Manager plugin to version 3.3.13 or higher.
Who is affected by CVE-2025-3404?
Users with the WordPress Download Manager plugin versions up to 3.3.12 are affected, specifically those with Author-level access and above.
What causes CVE-2025-3404?
CVE-2025-3404 is caused by insufficient file path validation in the savePackage function within the plugin.
Can CVE-2025-3404 be exploited remotely?
Yes, CVE-2025-3404 can be exploited remotely by authenticated attackers with the necessary privileges.