CVE-2025-4799 – The WP-DownloadManager plugin for WordPress has... (How to Fix)

Q: What is the severity of CVE-2025-4799?

CVE-2025-4799 has a CVSS score of 7.2 (HIGH). The WP-DownloadManager plugin for WordPress has a vulnerability allowing authenticated attackers with Administrator privileges to delete arbitrary files on the server. This can lead to remote code execution by deleting critical files like wp-config.php. All WordPress sites using vulnerable plugin versions are affected.

📋 TL;DR

The WP-DownloadManager plugin for WordPress has a vulnerability allowing authenticated attackers with Administrator privileges to delete arbitrary files on the server. This can lead to remote code execution by deleting critical files like wp-config.php. All WordPress sites using vulnerable plugin versions are affected.

💻 Affected Systems

Products:

WP-DownloadManager WordPress Plugin

Versions: All versions up to and including 1.68.10

Operating Systems: All

Default Config Vulnerable: ⚠️ Yes

Notes: Requires attacker to have Administrator-level WordPress access; can be combined with CVE-2025-4798 for broader impact.

📦 What is this software?

Wp Downloadmanager by Wp Downloadmanager Project

View all CVEs affecting Wp Downloadmanager →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete site compromise through remote code execution, data loss, and potential server takeover.

🟠

Likely Case

Site defacement, data destruction, and service disruption through deletion of critical WordPress files.

🟢

If Mitigated

Limited impact if proper access controls and file permissions are enforced.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated Administrator access; trivial to exploit once access is obtained.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Versions after 1.68.10

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3294467/

Restart Required: No

Instructions:

1. Update WP-DownloadManager plugin to latest version via WordPress admin panel. 2. Verify plugin version is greater than 1.68.10. 3. Test download functionality.

🔧 Temporary Workarounds

Disable or Remove Plugin

all

Temporarily disable or remove the vulnerable plugin until patching is possible.

wp plugin deactivate wp-downloadmanager
wp plugin delete wp-downloadmanager

Restrict Administrator Access

all

Implement strict access controls and multi-factor authentication for Administrator accounts.

🧯 If You Can't Patch

Implement strict file permissions (e.g., chmod 644 for wp-config.php, read-only for critical files)
Enable WordPress security plugins with file integrity monitoring and intrusion detection

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel > Plugins > WP-DownloadManager version. If version ≤ 1.68.10, vulnerable.

Check Version:

wp plugin list --name=wp-downloadmanager --field=version

Verify Fix Applied:

Verify plugin version > 1.68.10 and test file deletion functionality is restricted.

📡 Detection & Monitoring

Log Indicators:

Unusual file deletion events in WordPress logs
Multiple failed login attempts followed by plugin file operations

Network Indicators:

HTTP POST requests to download-options.php with file deletion parameters

SIEM Query:

source="wordpress.log" AND ("delete_file" OR "unlink" OR "wp-downloadmanager")

📊 Metadata

CVE ID: CVE-2025-4799

CVSS v3 Score: 7.2 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-36

EPSS Score: 2.37% exploit probability (84.6th percentile)

Published: June 11, 2025

Last Updated: July 9, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-4799, you might also want to check these: