CVE-2025-13498

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13498", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-21T01:04:54.935Z", "datePublished": "2025-12-18T07:20:46.463Z", "dateUpdated": "2026-04-08T17:32:41.969Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:32:41.969Z"}, "affected": [{"vendor": "codename065", "product": "Download Manager", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.3.32", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Download Manager plugin for WordPress is vulnerable to unauthorized access of sensitive information in all versions up to, and including, 3.3.32. This is due to missing authorization and capability checks on the `wpdm_media_access` AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve passwords and access control settings for protected media attachments, which can then be used to bypass the intended media protection and download restricted files."}], "title": "Download Manager <= 3.3.32 - Missing Authorization to Authenticated (Subscriber+) Media Attachment Password Disclosure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f2cdd50d-6290-4cef-a72c-2e9d680d4f1f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.32/src/MediaLibrary/MediaAccessControl.php#L26"}, {"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.32/src/MediaLibrary/MediaAccessControl.php#L275"}, {"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.32/src/MediaLibrary/MediaAccessControl.php#L299"}, {"url": "https://plugins.trac.wordpress.org/changeset/3413804/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "M Indra Purnama"}], "timeline": [{"time": "2025-12-01T19:03:32.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-17T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-18T15:26:47.026076Z", "id": "CVE-2025-13498", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-18T15:33:29.915Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13498", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-18T15:26:47.026076Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-18T15:26:48.255Z"}}], "cna": {"title": "Download Manager <= 3.3.32 - Missing Authorization to Authenticated (Subscriber+) Media Attachment Password Disclosure", "credits": [{"lang": "en", "type": "finder", "value": "M Indra Purnama"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "codename065", "product": "Download Manager", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.3.32"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-01T19:03:32.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-17T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f2cdd50d-6290-4cef-a72c-2e9d680d4f1f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.32/src/MediaLibrary/MediaAccessControl.php#L26"}, {"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.32/src/MediaLibrary/MediaAccessControl.php#L275"}, {"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.32/src/MediaLibrary/MediaAccessControl.php#L299"}, {"url": "https://plugins.trac.wordpress.org/changeset/3413804/"}], "descriptions": [{"lang": "en", "value": "The Download Manager plugin for WordPress is vulnerable to unauthorized access of sensitive information in all versions up to, and including, 3.3.32. This is due to missing authorization and capability checks on the `wpdm_media_access` AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve passwords and access control settings for protected media attachments, which can then be used to bypass the intended media protection and download restricted files."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:32:41.969Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13498", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:32:41.969Z", "dateReserved": "2025-11-21T01:04:54.935Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-18T07:20:46.463Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Download Manager", "vendor": "codename065", "versions": [{"lessThanOrEqual": "3.3.32", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Download Manager plugin for WordPress is vulnerable to unauthorized access of sensitive information in all versions up to, and including, 3.3.32. This is due to missing authorization and capability checks on the `wpdm_media_access` AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve passwords and access control settings for protected media attachments, which can then be used to bypass the intended media protection and download restricted files."}], "id": "CVE-2025-13498", "lastModified": "2026-06-17T08:34:15.233", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13498", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-18T15:26:47.026076Z", "version": "2.0.3"}}]}, "published": "2025-12-18T08:15:49.337", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.32/src/MediaLibrary/MediaAccessControl.php#L26"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.32/src/MediaLibrary/MediaAccessControl.php#L275"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.32/src/MediaLibrary/MediaAccessControl.php#L299"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3413804/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f2cdd50d-6290-4cef-a72c-2e9d680d4f1f?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T00:42:48.731431+00:00", "value": {"mitigation_remediation": ["Upgrade the Download Manager plugin to the latest version that addresses this issue (version 3.3.33 or newer).", "Restrict Subscriber\u2013level users from triggering wpdm_media_access by reconfiguring the plugin\u2019s capability settings or by applying custom code to enforce higher capability checks.", "Review existing media attachment passwords and regenerate them to ensure that any credentials exposed during the vulnerability window are no longer valid."], "summary": {"action": "Patch immediately", "impact": "Unauthorized disclosure of media passwords"}, "threat_synthesis": {"affected_systems": "The affected product is the codename065:Download Manager WordPress plugin, specifically all released versions up to and including 3.3.32. No other products or vendors are listed as affected.", "description_and_impact": "The Download Manager plugin for WordPress contains a flaw where the wpdm_media_access AJAX action performs no authorization or capability checks. An attacker who is authenticated, even with only Subscriber level access or higher, can fetch the passwords and access control settings that protect media attachments. Those retrieved credentials enable the attacker to sidestep the intended media protection mechanism and download files that should be restricted. The vulnerability is a straightforward case of missing authorization (CWE-862). The likely attack vector is via in\u2011application AJAX calls that expose sensitive data without verifying the user\u2019s permissions.", "risk_and_exploitability": "The CVSS score of 4.3 indicates a moderate severity. EPSS is below 1%, suggesting that widespread exploitation is unlikely at this time, and the vulnerability is not listed in CISA\u2019s KEV catalog. Nonetheless, any site that has Subscriber\u2013level users can be leveraged to retrieve media passwords, giving those users control over restricted content. Because the flaw requires only authenticated access, the risk to sites with large subscriber bases is non\u2011negligible, but it does not allow remote code execution or unrestricted system compromise."}}}}, "created": "2025-12-19T09:18:20.728810+00:00", "updated": "2026-04-21T00:45:23.100404+00:00", "vendors": ["codename065", "codename065$PRODUCT$download_manager_plugin", "wordpress", "wordpress$PRODUCT$wordpress"]}