PT-2025-51998 · WordPress · Download Manager

5Afe · Published 2025-12-18 · Updated 2025-12-20 · CVE-2025-13498

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Download Manager plugin for WordPress versions prior to 3.3.33

Description The Download Manager plugin for WordPress is susceptible to unauthorized access of sensitive information. This is caused by missing authorization and capability checks on the wpdm media access AJAX action. Attackers with Subscriber-level access or higher can retrieve passwords and access control settings for protected media attachments. This allows bypassing media protection and downloading restricted files.

Recommendations Update the Download Manager plugin to version 3.3.33 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-13498

Affected Products

Download Manager

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-13498 · Security Note
• https://twitter.com/CVEnew/status/2002466823891984531 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/f2cdd50d-6290-4cef-a72c-2e9d680d4f1f?source=cve · Note
• https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.32/src/MediaLibrary/MediaAccessControl.php#L26 · Note
• https://plugins.trac.wordpress.org/changeset/3413804 · Note
• https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.32/src/MediaLibrary/MediaAccessControl.php#L275 · Note
• https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.32/src/MediaLibrary/MediaAccessControl.php#L299 · Note