PT-2025-45551 · WordPress · Wordpress Download Manager

Jack Pas · CVE-2025-12177 · Published 2025-11-08 · Updated 2025-11-08

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WordPress Download Manager plugin versions prior to 3.3.31

Description The WordPress Download Manager plugin contains a flaw due to a hardcoded Cron key used in the deleteExpired() and clearTempDataCPCron() functions. This allows unauthenticated attackers to trigger these cron jobs, potentially leading to the deletion of expired posts and clearing of the cache.

Recommendations Update to version 3.3.31 or later.

Fix

Weakness Enumeration

CWE-321

Related Identifiers

CVE-2025-12177

Affected Products

Wordpress Download Manager

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-12177 · Security Note
• https://twitter.com/CVEnew/status/1987011690446131693 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1987097482136822124 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/17d5253c-5000-40c7-a7fd-f75d4badfb5e?source=cve · Note
• https://twitter.com/VolerionSec/status/1987012135000449236 · Twitter Post
• https://t.me/CVEtracker/36844 · Telegram Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3390068%40download-manager&new=3390068%40download-manager&sfp_email=&sfph_mail= · Note