CVE-2025-1785
Published: 13 March 2025
Description
Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.
Security Summary
CVE-2025-1785, published on 2025-03-13, is a directory traversal vulnerability (CWE-22) in the Download Manager plugin for WordPress, affecting all versions up to and including 3.3.08. The flaw exists in the 'wpdm_newfile' action, which allows authenticated attackers to overwrite select file types outside the originally intended directory. The vulnerability has a CVSS v3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).
Attackers with Author-level access or higher can exploit this issue remotely over the network with low attack complexity and no user interaction required. Successful exploitation enables overwriting files outside the plugin's designated directory, resulting in limited impacts to integrity and availability, which may lead to denial of service conditions.
Advisories and patch details are documented in the WordPress plugins trac changeset 3252990 and Wordfence threat intelligence page for the vulnerability (ID bc5c7974-4c10-4880-8823-2accee3c0da4).
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Directory traversal allowing file overwrite outside intended directory in public-facing WordPress plugin directly enables exploitation of the application (T1190) and stored data manipulation via integrity impact (T1565.001).