PT-2026-1363 · WordPress · Download Manager

Drew Webber · CVE-2025-15364 · Publicado 2026-01-06 · Atualizado 2026-01-06

Positive Technologies (AI Summary)

CVSS v3.1

7.3

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Download Manager plugin for WordPress versions prior to 3.3.41

Description The Download Manager plugin for WordPress is susceptible to privilege escalation, potentially leading to account takeover. The issue stems from insufficient user identity validation before allowing updates to user details, such as passwords. This allows unauthenticated attackers to modify user passwords—excluding those of administrators—and subsequently gain access to their accounts.

Recommendations Update the Download Manager plugin to version 3.3.41 or later.

Correção

LPE

Enumeração de Fraquezas

CWE-353

Identificadores relacionados

CVE-2025-15364

Produtos afetados

Download Manager

Referências · 7

• https://twitter.com/CVEnew/status/2008391002202177616 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.40/src/__/Crypt.php#L18 · Nota
• https://twitter.com/RedPacketSec/status/2008493276639244598 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/067031e8-6aa8-451c-a318-b1848c7a4f92?source=cve · Nota
• https://t.me/cveNotify/147791 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-15364 · Nota de Segurança
• https://plugins.trac.wordpress.org/changeset/3431915/download-manager#file7 · Nota