CVE-2025-12177
📋 TL;DR
The Download Manager WordPress plugin contains a hardcoded cron key vulnerability that allows unauthenticated attackers to trigger deletion of expired posts and cache clearing. This affects all WordPress sites using Download Manager versions up to 3.3.30. Attackers can disrupt website functionality by removing content without authentication.
💻 Affected Systems
- WordPress Download Manager Plugin
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete loss of expired content and cached data, potentially disrupting website functionality and user experience if critical posts are deleted.
Likely Case
Intermittent content loss and cache clearing causing temporary website performance issues and broken links.
If Mitigated
Minimal impact with proper monitoring and backups in place to restore deleted content.
🎯 Exploit Status
Exploitation requires simple HTTP requests to trigger cron endpoints with hardcoded key.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.3.31
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find Download Manager plugin
4. Click 'Update Now' if update available
5. Alternatively, download version 3.3.31+ from WordPress repository
6. Deactivate old version and upload new version
7. Activate updated plugin
🔧 Temporary Workarounds
Disable Plugin
allTemporarily deactivate the Download Manager plugin until patched
Block Cron Endpoints
linuxUse web application firewall or .htaccess to block access to plugin cron endpoints
# Add to .htaccess
RewriteEngine On
RewriteCond %{REQUEST_URI} .*download-manager.*cron.* [NC]
RewriteRule .* - [F,L]
🧯 If You Can't Patch
- Implement strict network controls to block external access to WordPress cron endpoints
- Enable comprehensive logging and monitoring for unauthorized deletion events
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins for Download Manager version. If version is 3.3.30 or lower, system is vulnerable.Check Version:
wp plugin list --name=download-manager --field=versionVerify Fix Applied:
Verify plugin version is 3.3.31 or higher in WordPress admin panel. Test cron endpoints return 403/404 instead of executing functions.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /wp-content/plugins/download-manager/*cron* endpoints
- Unauthenticated POST requests triggering deleteExpired or clearTempDataCPCron functions
- Sudden increase in post deletion or cache clearing events
Network Indicators:
- Unusual traffic patterns to plugin cron endpoints from external IPs
- HTTP requests containing hardcoded cron key parameter
SIEM Query:
source="web_logs" AND (uri="*download-manager*cron*" OR user_agent="*cron*" OR params="*cron_key*") AND status=200