CVE-2025-12177

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12177", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-24T15:57:21.778Z", "datePublished": "2025-11-08T03:27:45.992Z", "dateUpdated": "2026-04-08T16:37:29.806Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:37:29.806Z"}, "affected": [{"vendor": "codename065", "product": "Download Manager", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.3.30", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Download Manager plugin for WordPress is vulnerable to unauthorized access due to a hardcoded Cron key used in the deleteExpired() and clearTempDataCPCron() functions in all versions up to, and including, 3.3.30. This makes it possible for unauthenticated attackers to trigger these cron jobs leading to deletion of expired posts and clearing cache."}], "title": "Download Manager <= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron Key", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/17d5253c-5000-40c7-a7fd-f75d4badfb5e?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3390068%40download-manager&new=3390068%40download-manager&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-321 Use of Hard-coded Cryptographic Key", "cweId": "CWE-321", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Jack Pas"}], "timeline": [{"time": "2025-10-24T16:12:41.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-07T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-10T20:03:13.844824Z", "id": "CVE-2025-12177", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-10T20:09:53.311Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12177", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-10T20:03:13.844824Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-10T20:03:20.250Z"}}], "cna": {"title": "Download Manager <= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron Key", "credits": [{"lang": "en", "type": "finder", "value": "Jack Pas"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "codename065", "product": "Download Manager", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.3.30"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-24T16:12:41.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-07T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/17d5253c-5000-40c7-a7fd-f75d4badfb5e?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3390068%40download-manager&new=3390068%40download-manager&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Download Manager plugin for WordPress is vulnerable to unauthorized access due to a hardcoded Cron key used in the deleteExpired() and clearTempDataCPCron() functions in all versions up to, and including, 3.3.30. This makes it possible for unauthenticated attackers to trigger these cron jobs leading to deletion of expired posts and clearing cache."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-321", "description": "CWE-321 Use of Hard-coded Cryptographic Key"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:37:29.806Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12177", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:37:29.806Z", "dateReserved": "2025-10-24T15:57:21.778Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-08T03:27:45.992Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Download Manager", "vendor": "codename065", "versions": [{"lessThanOrEqual": "3.3.30", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Download Manager plugin for WordPress is vulnerable to unauthorized access due to a hardcoded Cron key used in the deleteExpired() and clearTempDataCPCron() functions in all versions up to, and including, 3.3.30. This makes it possible for unauthenticated attackers to trigger these cron jobs leading to deletion of expired posts and clearing cache."}, {"lang": "es", "value": "El plugin Download Manager para WordPress es vulnerable a acceso no autorizado debido a una clave Cron codificada de forma r\u00edgida utilizada en las funciones deleteExpired() y clearTempDataCPCron() en todas las versiones hasta la 3.3.30, inclusive. Esto hace posible que atacantes no autenticados activen estos trabajos cron, lo que lleva a la eliminaci\u00f3n de publicaciones caducadas y la limpieza de la cach\u00e9."}], "id": "CVE-2025-12177", "lastModified": "2026-10-07T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12177", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-10T20:03:13.844824Z", "version": "2.0.3"}}]}, "published": "2025-11-08T04:15:45.033", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3390068%40download-manager&new=3390068%40download-manager&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/17d5253c-5000-40c7-a7fd-f75d4badfb5e?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-321"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T16:43:11.069207+00:00", "value": {"mitigation_remediation": ["Upgrade the Download Manager plugin to the latest version, which removes the hard\u2011coded cron key or replaces it with a secure, unique key.", "If an immediate upgrade is not possible, disable or remove the deleteExpired() and clearTempDataCPCron() cron functions, or block the URL paths that execute them.", "Apply a web application firewall rule or rewrite rule to block requests containing the old hard\u2011coded key, ensuring that only authenticated users can trigger similar cron operations.", "Verify that any scheduled tasks on the site that rely on these functions are reconfigured to use web\u2011hooks or secure cron mechanisms."], "summary": {"action": "Apply Patch", "impact": "Unauthorized Deletion of Content"}, "threat_synthesis": {"affected_systems": "Codename065\u2019s Download Manager plugin for WordPress, version 3.3.30 and older, is affected. All installations of the plugin up to that release are vulnerable.", "description_and_impact": "The vulnerability in the Download Manager WordPress plugin is caused by a hard\u2011coded cron key used in deleteExpired() and clearTempDataCPCron(). An attacker can call these functions without authentication, which results in deletion of expired posts and clearing of cached data, potentially causing loss of posts and site performance issues.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity. EPSS shows less than 1% exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to send a request containing the hard\u2011coded key, which is likely embedded in the code, to trigger the cron jobs. Without user authentication, the attack can be performed by anyone who can reach the target site. Given the low EPSS, widespread exploitation is unlikely, but the impact on content loss warrants patching."}}}}, "created": "2025-11-10T09:33:39.196266+00:00", "updated": "2026-04-22T16:45:21.464134+00:00", "vendors": ["codename065", "codename065$PRODUCT$download_manager_plugin", "wordpress", "wordpress$PRODUCT$wordpress"]}