PT-2026-1363 · WordPress · Download Manager

Drew Webber · Published 2026-01-06 · Updated 2026-01-06 · CVE-2025-15364

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Download Manager plugin for WordPress versions prior to 3.3.41

Description The Download Manager plugin for WordPress is susceptible to privilege escalation, potentially leading to account takeover. The issue stems from insufficient user identity validation before allowing updates to user details, such as passwords. This allows unauthenticated attackers to modify user passwords—excluding those of administrators—and subsequently gain access to their accounts.

Recommendations Update the Download Manager plugin to version 3.3.41 or later.

Fix

LPE

Weakness Enumeration

CWE-353

Related Identifiers

CVE-2025-15364

Affected Products

Download Manager

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-15364 · Security Note
• https://twitter.com/CVEnew/status/2008391002202177616 · Twitter Post
• https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.40/src/__/Crypt.php#L18 · Note
• https://twitter.com/RedPacketSec/status/2008493276639244598 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/067031e8-6aa8-451c-a318-b1848c7a4f92?source=cve · Note
• https://t.me/cveNotify/147791 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3431915/download-manager#file7 · Note