{"id":33857,"date":"2025-04-29T23:02:22","date_gmt":"2025-04-29T23:02:22","guid":{"rendered":""},"modified":"2025-09-08T10:19:24","modified_gmt":"2025-09-08T16:19:24","slug":"cve-2025-3404-wordpress-download-manager-arbitrary-file-deletion-vulnerability","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-3404-wordpress-download-manager-arbitrary-file-deletion-vulnerability\/","title":{"rendered":"CVE-2025-3404: WordPress Download Manager Arbitrary File Deletion Vulnerability<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The CVE-2025-3404 is a critical vulnerability in the Download Manager plugin for WordPress, affecting all versions up to and including 3.3.12. This vulnerability can lead to arbitrary file deletion, potentially rendering a website non-functional or even allowing an attacker to execute remote code. This advisory outlines the specifics of the vulnerability, who it affects, its potential consequences, and how to mitigate it. As WordPress is widely used across the internet, this vulnerability carries significant risk for unpatched systems<\/a>.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-3404
\nSeverity: High (CVSS: 8.8)
\nAttack Vector: Network
\nPrivileges Required: High (Author-level access and above)
\nUser Interaction: Required
\nImpact: Potential system compromise or data<\/a> leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

WordPress Download Manager<\/a> | Versions up to and including 3.3.12<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The vulnerability lies in the savePackage function of the Download Manager<\/a> plugin, which does not properly validate file paths. With this, an attacker with author-level access can craft a request to the server to delete arbitrary files<\/a>. If the attacker chooses to delete a critical file, like wp-config.php, it can lead to remote code execution<\/a>, thus compromising the system.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Here’s a conceptual example of how an attacker might exploit<\/a> this vulnerability. It’s an HTTP request that instructs the server to delete a specific file<\/a>:<\/p>\n

POST \/wp-admin\/admin-ajax.php?action=wpdm_save_package HTTP\/1.1\nHost: target.example.com\nContent-Type: application\/x-www-form-urlencoded\n_ID=1&__wpdmfile[files][]=..\/..\/..\/..\/wp-config.php<\/code><\/pre>\n
In the above example, the attacker is instructing the server to delete the wp-config.php file, which is a crucial file in a WordPress<\/a> installation. Deleting this can lead to a system<\/a> compromise.<\/p>\n
Mitigation Guidance<\/strong><\/p>\n
Users of the WordPress Download Manager<\/a> plugin should immediately apply the vendor patch to fix this vulnerability. If a patch cannot be applied immediately, a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can be used as temporary mitigation. These systems can be configured to block requests that attempt to exploit this vulnerability<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview The CVE-2025-3404 is a critical vulnerability in the Download Manager plugin for WordPress, affecting all versions up to and including 3.3.12. This vulnerability can lead to arbitrary file deletion, potentially rendering a website non-functional or even allowing an attacker to execute remote code. This advisory outlines the specifics of the vulnerability, who it affects, […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[80],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-33857","post","type-post","status-publish","format-standard","hentry","category-uncategorized","attack_vector-rce"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t