CVE-2025-15364

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-15364", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-30T14:21:41.555Z", "datePublished": "2026-01-06T01:50:12.652Z", "dateUpdated": "2026-04-08T16:33:45.276Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:33:45.276Z"}, "affected": [{"vendor": "codename065", "product": "Download Manager", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.3.40", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Download Manager plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.3.40. This is due to the plugin not properly validating a user's identity prior to updating their details like password. This makes it possible for unauthenticated attackers to change user's passwords, except administrators, and leverage that to gain access to their account."}], "title": "Download Manager <= 3.3.40 - Unauthenticated Limited Privilege Escalation via updatePassword", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/067031e8-6aa8-451c-a318-b1848c7a4f92?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.40/src/__/Crypt.php#L18"}, {"url": "https://plugins.trac.wordpress.org/changeset/3431915/download-manager#file7"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-353 Missing Support for Integrity Check", "cweId": "CWE-353", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "baseScore": 7.3, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Drew Webber"}], "timeline": [{"time": "2025-12-30T14:38:48.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-05T13:11:34.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-06T14:20:09.826991Z", "id": "CVE-2025-15364", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-06T18:57:23.139Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-15364", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-06T14:20:09.826991Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-06T14:20:11.535Z"}}], "cna": {"title": "Download Manager <= 3.3.40 - Unauthenticated Limited Privilege Escalation via updatePassword", "credits": [{"lang": "en", "type": "finder", "value": "Drew Webber"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"}}], "affected": [{"vendor": "codename065", "product": "Download Manager", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.3.40"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-30T14:38:48.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-05T13:11:34.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/067031e8-6aa8-451c-a318-b1848c7a4f92?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.40/src/__/Crypt.php#L18"}, {"url": "https://plugins.trac.wordpress.org/changeset/3431915/download-manager#file7"}], "descriptions": [{"lang": "en", "value": "The Download Manager plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.3.40. This is due to the plugin not properly validating a user's identity prior to updating their details like password. This makes it possible for unauthenticated attackers to change user's passwords, except administrators, and leverage that to gain access to their account."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-353", "description": "CWE-353 Missing Support for Integrity Check"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:33:45.276Z"}}}, "cveMetadata": {"cveId": "CVE-2025-15364", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:33:45.276Z", "dateReserved": "2025-12-30T14:21:41.555Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-06T01:50:12.652Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Download Manager", "vendor": "codename065", "versions": [{"lessThanOrEqual": "3.3.40", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Download Manager plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.3.40. This is due to the plugin not properly validating a user's identity prior to updating their details like password. This makes it possible for unauthenticated attackers to change user's passwords, except administrators, and leverage that to gain access to their account."}, {"lang": "es", "value": "El plugin Download Manager para WordPress es vulnerable a la escalada de privilegios mediante la toma de control de cuentas en todas las versiones hasta la 3.3.40, inclusive. Esto se debe a que el plugin no valida correctamente la identidad de un usuario antes de actualizar sus detalles, como la contrase\u00f1a. Esto hace posible que atacantes no autenticados cambien las contrase\u00f1as de los usuarios, excepto las de los administradores, y aprovechen eso para obtener acceso a su cuenta."}], "id": "CVE-2025-15364", "lastModified": "2026-10-07T10:10:00.213", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15364", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-06T14:20:09.826991Z", "version": "2.0.3"}}]}, "published": "2026-01-06T02:15:41.193", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.40/src/__/Crypt.php#L18"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3431915/download-manager#file7"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/067031e8-6aa8-451c-a318-b1848c7a4f92?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-353"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T15:59:01.971132+00:00", "value": {"mitigation_remediation": ["Upgrade to the latest version of Download Manager (3.3.41 or newer).", "Disable or restrict access to the updatePassword endpoint for non\u2011authenticated users by enforcing a nonce or role check.", "Monitor account activity logs for unexpected password changes and confirm user credentials after updates."], "summary": {"action": "Apply Patches", "impact": "Unauthenticated Limited Privilege Escalation"}, "threat_synthesis": {"affected_systems": "Codename065's Download Manager plugin for WordPress, versions 3.3.40 and earlier, are affected.", "description_and_impact": "The Download Manager WordPress plugin fails to validate a user's identity before allowing a password change. An unauthenticated attacker can modify non\u2011administrator user passwords through the updatePassword function. After changing the password, the attacker can log in as that user and may gain limited privilege according to the user's role. This vulnerability is rooted in improper authentication handling (CWE\u2011353).", "risk_and_exploitability": "The CVSS score is 7.3, indicating a high impact if exploited. The EPSS score of less than 1\u202f% shows a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely unauthenticated, remote, with the attacker sending crafted HTTP requests to the plugin\u2019s updatePassword endpoint. No authentication is performed before the password change, allowing the attacker to proceed once the request reaches the plugin."}}}}, "created": "2026-01-06T14:16:06.379295+00:00", "updated": "2026-04-22T16:00:12.109240+00:00", "vendors": ["codename065", "codename065$PRODUCT$download_manager_plugin", "wordpress", "wordpress$PRODUCT$wordpress"]}