CVE-2025-10747: WP-DownloadManager Plugin RCE Vulnerability

CVE-2025-10747 Overview

CVE-2025-10747 is an arbitrary file upload vulnerability in the WP-DownloadManager plugin for WordPress. The flaw exists in the download-add.php file across all versions up to and including 1.68.11. The plugin fails to validate file types before accepting uploads, allowing authenticated attackers with Administrator-level access or above to upload arbitrary files to the server. Successful exploitation can lead to remote code execution on the affected WordPress instance. The vulnerability is classified under [CWE-434] Unrestricted Upload of File with Dangerous Type.

Critical Impact
Authenticated administrators can upload PHP files or other executable content, enabling remote code execution and full compromise of the underlying web server.

Affected Products

WordPress WP-DownloadManager plugin versions up to and including 1.68.11
WordPress installations using the vulnerable download-add.php upload handler
Any site permitting Administrator or higher-privileged accounts to access the plugin

Discovery Timeline

2025-09-26 - CVE-2025-10747 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-10747

Vulnerability Analysis

The WP-DownloadManager plugin exposes an administrative upload handler in download-add.php that accepts user-supplied files without performing file type validation. The handler stores uploaded content within the web-accessible WordPress directory structure. Because no MIME type allowlist, extension allowlist, or content inspection is enforced, an attacker can upload executable PHP files alongside legitimate download artifacts. Once written to disk, the attacker can invoke the uploaded script through a direct HTTP request, achieving remote code execution under the privileges of the PHP worker process.

Root Cause

The root cause is missing input validation on the upload routine within download-add.php at the file processing logic. The plugin treats the upload as a trusted administrative action and writes the file using the original extension. This violates secure upload guidance, which requires both server-side extension allowlisting and content-type verification before persisting user-controlled files.

Attack Vector

Exploitation requires an authenticated session with Administrator privileges or higher. The attacker navigates to the plugin's download upload interface and submits a crafted multipart form request containing a malicious PHP payload disguised as a download asset. The server stores the file in a predictable location, and the attacker then issues a follow-up GET request to execute the payload. Attack vectors include compromised administrator credentials, privilege escalation from a lower-privileged account, or insider abuse.

No public proof-of-concept exploit code is currently published. See the Wordfence Vulnerability Report and the WordPress Plugin Code Reference for technical details on the affected code path.

Detection Methods for CVE-2025-10747

Indicators of Compromise

Unexpected .php, .phtml, .phar, or other executable files appearing within the WP-DownloadManager upload directories
Web server access logs showing POST requests to wp-admin/admin.php?page=download-add followed by GET requests to newly created files
New or modified WordPress administrator accounts performing upload activity outside normal change windows
Outbound network connections initiated by the PHP-FPM or Apache worker process to attacker-controlled infrastructure

Detection Strategies

Monitor file integrity within wp-content directories for the creation of script files following plugin upload activity
Inspect WordPress audit logs for upload events generated by download-add.php and correlate with administrator login sources
Apply web application firewall rules that block multipart uploads containing PHP shebangs, <?php tags, or polyglot file signatures targeting the plugin endpoint

Monitoring Recommendations

Singularity Endpoint behavioral AI can flag anomalous process execution chains where the web server spawns shells or executes newly written scripts, surfacing post-upload code execution attempts
Forward WordPress and web server logs to Singularity Data Lake for correlation with endpoint telemetry and retroactive hunting against this CVE
Alert on administrator account logins from new geolocations or user agents that immediately precede plugin upload activity

How to Mitigate CVE-2025-10747

Immediate Actions Required

Update the WP-DownloadManager plugin to a version newer than 1.68.11 as soon as the vendor publishes a fixed release
Audit all WordPress administrator accounts, enforce strong passwords, and require multi-factor authentication for privileged users
Review the plugin upload directories for unauthorized files and remove any executable content not associated with legitimate downloads
Rotate administrator credentials and API keys if signs of exploitation are present

Patch Information

The WordPress plugin repository tracks remediation activity in the WordPress Plugin Changeset. Administrators should consult the WordPress Plugin Overview for the latest available release and apply updates through the WordPress admin dashboard or via WP-CLI.

Workarounds

Deactivate and remove the WP-DownloadManager plugin until a patched version is installed
Restrict access to /wp-admin/ using IP allowlisting at the web server or reverse proxy layer
Configure the web server to deny PHP execution within the plugin's upload directory using .htaccess rules or equivalent Nginx location blocks
Limit Administrator role assignments to the minimum number of trusted users

bash

# Apache: disable PHP execution within WP-DownloadManager upload directory
# Place in wp-content/uploads/downloads/.htaccess
<FilesMatch "\.(php|phtml|phar|php7|php8)$">
    Require all denied
</FilesMatch>

# Nginx equivalent
# location ~* /wp-content/uploads/downloads/.*\.(php|phtml|phar)$ {
#     deny all;
#     return 403;
# }