CVE-2025-12961: WordPress Download Panel Auth Bypass Flaw

CVE-2025-12961 Overview

The Download Panel plugin for WordPress contains a missing authorization vulnerability affecting all versions up to and including 1.3.3. The flaw resides in the dlpn_save_settings() function, which handles the wp_ajax_save_settings AJAX action without performing a capability check. Authenticated attackers with Subscriber-level access or higher can modify plugin settings, including display text, download links, button colors, and other visual customizations. The issue is tracked as a Missing Authorization weakness [CWE-862].

Critical Impact
Any authenticated WordPress user, including low-privilege Subscribers, can tamper with Download Panel settings and replace legitimate download links with attacker-controlled URLs.

Affected Products

Download Panel plugin for WordPress
All versions up to and including 1.3.3
WordPress sites permitting Subscriber-level or higher registration

Discovery Timeline

2025-11-18 - CVE-2025-12961 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12961

Vulnerability Analysis

The Download Panel plugin registers the wp_ajax_save_settings AJAX action to allow administrators to update plugin configuration from the WordPress dashboard. The handler function dlpn_save_settings() writes user-supplied values directly into plugin options without verifying that the caller holds an administrative capability such as manage_options. WordPress registers wp_ajax_* handlers for any logged-in user by default, so authentication alone does not restrict access. A Subscriber account can therefore invoke the same endpoint an administrator uses. The impact is limited to integrity of plugin settings, with no direct confidentiality or availability loss.

Root Cause

The root cause is the absence of a current_user_can() check inside dlpn_save_settings(). The plugin also omits nonce verification through check_ajax_referer() for privileged callers, meaning neither capability nor request-origin controls gate the write. The relevant handler is registered at lines 50 and 51 of plugin.php in the version 1.3.3 source tree. See the WordPress Plugin Code Reference for the vulnerable registration.

Attack Vector

Exploitation requires a valid WordPress account with at least Subscriber privileges on a site running the affected plugin. The attacker sends a POST request to /wp-admin/admin-ajax.php with action=save_settings and attacker-chosen values for the plugin option fields. Because settings include download URLs, an attacker can redirect visitors to malware distribution sites or phishing pages while retaining the legitimate site's branding. Refer to the Wordfence Vulnerability Report for additional analysis.

Detection Methods for CVE-2025-12961

Indicators of Compromise

Unexpected modifications to Download Panel plugin options, particularly download URLs pointing to external domains
POST requests to /wp-admin/admin-ajax.php with the parameter action=save_settings originating from non-administrator user sessions
Changes to display text, button colors, or link labels that were not initiated by site administrators

Detection Strategies

Review WordPress access logs for admin-ajax.php calls tied to save_settings and correlate the authenticated user ID against the site's administrator list
Audit the wp_options table for recent changes to Download Panel entries and compare current values against known-good backups
Enable a Web Application Firewall (WAF) rule that blocks the save_settings action for users lacking the manage_options capability

Monitoring Recommendations

Alert on Subscriber or Contributor accounts issuing POSTs to admin-ajax.php with plugin management actions
Monitor outbound clicks from download buttons to detect redirection to unexpected external domains
Track new user registrations on sites that allow open registration and correlate with subsequent AJAX activity

How to Mitigate CVE-2025-12961

Immediate Actions Required

Update the Download Panel plugin to a version newer than 1.3.3 once the vendor publishes a patched release
Restrict new user registration or lower default roles below Subscriber where feasible until a fix is deployed
Audit current plugin settings and restore any tampered download links from a trusted backup

Patch Information

At the time of NVD publication, no fixed version was listed in the advisory. Site owners should monitor the plugin's WordPress.org listing and the Wordfence Vulnerability Report for release information. When a patched version becomes available, verify that dlpn_save_settings() includes a current_user_can('manage_options') check and a nonce verification call.

Workarounds

Deactivate the Download Panel plugin until a patched release is installed
Deploy a WAF rule that blocks admin-ajax.php requests with action=save_settings unless the session cookie belongs to an administrator
Disable open user registration by setting Anyone can register to off under WordPress General Settings

bash

# Disable open registration via WP-CLI
wp option update users_can_register 0

# List installed plugins and confirm Download Panel status
wp plugin list --name=download-panel

# Deactivate the plugin until a fix is available
wp plugin deactivate download-panel