CVE-2025-12177: WordPress Download Manager Auth Bypass

CVE-2025-12177 Overview

The Download Manager plugin for WordPress contains a hardcoded Cron key vulnerability affecting all versions up to and including 3.3.30. The flaw resides in the deleteExpired() and clearTempDataCPCron() functions, which rely on a static, predictable key for authorization. Unauthenticated attackers can invoke these cron jobs remotely by supplying the hardcoded key. Successful exploitation results in deletion of expired posts and clearing of cached data on the affected site. The issue is tracked under CWE-321: Use of Hard-coded Cryptographic Key.

Critical Impact
Unauthenticated attackers can trigger internal cron jobs to delete expired posts and clear cache data on affected WordPress sites.

Affected Products

Download Manager plugin for WordPress, all versions through 3.3.30
WordPress sites with the plugin installed and activated
Any hosting environment exposing WordPress admin-ajax or cron endpoints

Discovery Timeline

2025-11-08 - CVE-2025-12177 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12177

Vulnerability Analysis

The Download Manager plugin uses a hardcoded value as the authorization key for two cron-triggered functions: deleteExpired() and clearTempDataCPCron(). Because the key is embedded in the plugin source code, it is neither secret nor unique per installation. Any attacker who inspects the public plugin code can extract the key and use it to invoke the cron endpoints without authentication. The vulnerability is exploitable over the network with low attack complexity and requires no user interaction. According to the Exploit Prediction Scoring System, the probability of exploitation activity is currently 0.219%.

Root Cause

The root cause is the use of a static, hardcoded cryptographic key for cron job authorization, classified as CWE-321. Cron authorization should rely on secrets that are generated per site and stored securely, not values distributed in the plugin's source. Because every installation of the plugin shares the same key, an attacker can target any vulnerable site without reconnaissance.

Attack Vector

An attacker sends an HTTP request to the WordPress site's cron entry point with parameters that trigger deleteExpired() or clearTempDataCPCron(), supplying the hardcoded key value. The plugin validates the key against its embedded constant and executes the cron job. The result is deletion of expired posts and clearing of temporary cache data, which impacts content integrity and site availability for cached resources. See the Wordfence Vulnerability Report for additional detail.

No verified proof-of-concept code is publicly available. Refer to the WordPress Changeset Update for the vendor fix.

Detection Methods for CVE-2025-12177

Indicators of Compromise

Unexpected deletion of posts marked as expired within the Download Manager plugin
Unexplained clearing of Download Manager cache and temporary data
Repeated HTTP requests to wp-cron.php or admin-ajax endpoints referencing Download Manager cron actions from unauthenticated sources

Detection Strategies

Inspect web server access logs for requests to WordPress cron endpoints containing Download Manager cron action parameters from external IPs
Correlate WordPress audit logs with cache-clear and post-deletion events lacking a corresponding administrative session
Compare installed plugin version against 3.3.30 and flag any equal or lower version

Monitoring Recommendations

Enable a WordPress activity log plugin to record post deletions and plugin cron executions with source IP attribution
Monitor HTTP request patterns to wp-cron.php for anomalous frequency or unauthenticated triggers
Alert on Download Manager plugin version drift across managed WordPress fleets

How to Mitigate CVE-2025-12177

Immediate Actions Required

Update the Download Manager plugin to a version newer than 3.3.30 that addresses the hardcoded cron key
Audit recent post-deletion and cache-clear events for signs of unauthorized cron invocation
Restrict access to wp-cron.php from untrusted networks where feasible

Patch Information

The vendor addressed the issue in the changeset referenced by the WordPress Plugin Repository. Site administrators should apply the update through the WordPress admin plugin interface or via WP-CLI. Verify the plugin version after upgrade and confirm cron functionality operates using a per-site secret rather than a static key.

Workarounds

Disable the Download Manager plugin until the patched version is deployed
Block external HTTP access to wp-cron.php and trigger cron via a system scheduler instead
Deploy a Web Application Firewall rule to block requests containing the known cron action parameters from unauthenticated sources

bash

# Trigger WordPress cron via system scheduler and block external HTTP access
# 1. Disable public wp-cron by adding to wp-config.php:
#    define('DISABLE_WP_CRON', true);
# 2. Add a system cron entry to invoke cron locally:
*/15 * * * * cd /var/www/html && /usr/bin/php wp-cron.php >/dev/null 2>&1