PT-2025-51820 · WordPress · Download Plugins/Themes In Zip From Dashboard

Lorenzo Franchini · Published 2025-12-17 · Updated 2025-12-17 · CVE-2025-14399

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Download Plugins and Themes in ZIP from Dashboard plugin for WordPress versions through 1.9.6

Description The software is susceptible to a Cross-Site Request Forgery (CSRF) issue. This is due to inadequate or missing nonce validation within the download plugin bulk and download theme bulk functions. An unauthenticated attacker could potentially archive all site plugins and themes, placing them in the wp-content/uploads/ directory, by forging a request and tricking a site administrator into performing an action.

Recommendations Update the Download Plugins and Themes in ZIP from Dashboard plugin for WordPress to a version later than 1.9.6.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-14399

Affected Products

Download Plugins/Themes In Zip From Dashboard

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-14399 · Security Note
• https://t.me/CVEtracker/40041 · Telegram Post
• https://t.me/cveNotify/146065 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3417484/download-plugins-dashboard · Note
• https://twitter.com/CVEnew/status/2001350816595349530 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2001229567315300858 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/845b6bcf-004b-4b92-88d7-3d331fa58c11?source=cve · Note