PT-2025-45541 · WordPress · Simple Downloads List

Published 2025-11-08 · Updated 2025-11-08 · CVE-2025-12583

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Simple Downloads List plugin for WordPress versions up to and including 1.4.3

Description The Simple Downloads List plugin for WordPress is susceptible to unauthorized data modification. This is due to a missing capability check on the wp ajax neofix sdl edit API endpoint, and other similar endpoints. Authenticated attackers with Subscriber-level access or higher can alter plugin settings and downloads, potentially injecting malicious web scripts.

Recommendations Update the Simple Downloads List plugin to a version beyond 1.4.3.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-12583

Affected Products

Simple Downloads List

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-12583 · Security Note
• https://plugins.trac.wordpress.org/browser/simple-downloads-list/tags/1.5.0/admin/adminpanel_v3.php?rev=3388438 · Note
• https://twitter.com/CVEnew/status/1986999088207049205 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?old_path=/simple-downloads-list/tags/1.4.3&new_path=/simple-downloads-list/tags/1.5.0&sfp_email=&sfph_mail= · Note
• https://t.me/CVEtracker/36842 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/cbee3d3b-383b-48f5-be63-61cd692a18a0?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1987128198329401429 · Twitter Post
• https://t.me/cveNotify/142195 · Telegram Post