CVE-2025-3404: WordPress Download Manager Arbitrary File Deletion Vulnerability

Overview

The CVE-2025-3404 is a critical vulnerability in the Download Manager plugin for WordPress, affecting all versions up to and including 3.3.12. This vulnerability can lead to arbitrary file deletion, potentially rendering a website non-functional or even allowing an attacker to execute remote code. This advisory outlines the specifics of the vulnerability, who it affects, its potential consequences, and how to mitigate it. As WordPress is widely used across the internet, this vulnerability carries significant risk for unpatched systems.

Vulnerability Summary

CVE ID: CVE-2025-3404
Severity: High (CVSS: 8.8)
Attack Vector: Network
Privileges Required: High (Author-level access and above)
User Interaction: Required
Impact: Potential system compromise or data leakage

Affected Products

Product | Affected Versions

WordPress Download Manager | Versions up to and including 3.3.12

How the Exploit Works

The vulnerability lies in the savePackage function of the Download Manager plugin, which does not properly validate file paths. With this, an attacker with author-level access can craft a request to the server to delete arbitrary files. If the attacker chooses to delete a critical file, like wp-config.php, it can lead to remote code execution, thus compromising the system.

Conceptual Example Code

Here’s a conceptual example of how an attacker might exploit this vulnerability. It’s an HTTP request that instructs the server to delete a specific file:

POST /wp-admin/admin-ajax.php?action=wpdm_save_package HTTP/1.1
Host: target.example.com
Content-Type: application/x-www-form-urlencoded
_ID=1&__wpdmfile[files][]=../../../../wp-config.php

In the above example, the attacker is instructing the server to delete the wp-config.php file, which is a crucial file in a WordPress installation. Deleting this can lead to a system compromise.

Mitigation Guidance

Users of the WordPress Download Manager plugin should immediately apply the vendor patch to fix this vulnerability. If a patch cannot be applied immediately, a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can be used as temporary mitigation. These systems can be configured to block requests that attempt to exploit this vulnerability.