Overview
The CVE-2025-3404 is a critical vulnerability in the Download Manager plugin for WordPress, affecting all versions up to and including 3.3.12. This vulnerability can lead to arbitrary file deletion, potentially rendering a website non-functional or even allowing an attacker to execute remote code. This advisory outlines the specifics of the vulnerability, who it affects, its potential consequences, and how to mitigate it. As WordPress is widely used across the internet, this vulnerability carries significant risk for unpatched systems.
Vulnerability Summary
CVE ID: CVE-2025-3404
Severity: High (CVSS: 8.8)
Attack Vector: Network
Privileges Required: High (Author-level access and above)
User Interaction: Required
Impact: Potential system compromise or data leakage
Affected Products
Share secrets securely
Ameeba is private infrastructure for communication and sensitive work built on encrypted identity instead of exposed corporate identity systems.
Passwords, credentials, confidential files, screenshots, internal discussions, sensitive AI context, and private coordination should not become exposed across ordinary communication platforms.
- • Encrypted identity
- • Private Spaces for organizations and teams
- • End-to-end encrypted chat, calls, files, and notes
- • Sensitive AI work and protected collaboration
- • Built for information that cannot leak
Our mission is to secure human work alongside AI.
Product | Affected Versions
WordPress Download Manager | Versions up to and including 3.3.12
How the Exploit Works
The vulnerability lies in the savePackage function of the Download Manager plugin, which does not properly validate file paths. With this, an attacker with author-level access can craft a request to the server to delete arbitrary files. If the attacker chooses to delete a critical file, like wp-config.php, it can lead to remote code execution, thus compromising the system.
Conceptual Example Code
Here’s a conceptual example of how an attacker might exploit this vulnerability. It’s an HTTP request that instructs the server to delete a specific file:
POST /wp-admin/admin-ajax.php?action=wpdm_save_package HTTP/1.1
Host: target.example.com
Content-Type: application/x-www-form-urlencoded
_ID=1&__wpdmfile[files][]=../../../../wp-config.phpIn the above example, the attacker is instructing the server to delete the wp-config.php file, which is a crucial file in a WordPress installation. Deleting this can lead to a system compromise.
Mitigation Guidance
Users of the WordPress Download Manager plugin should immediately apply the vendor patch to fix this vulnerability. If a patch cannot be applied immediately, a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can be used as temporary mitigation. These systems can be configured to block requests that attempt to exploit this vulnerability.