CVE-2025-1730 Overview
CVE-2025-1730 is an arbitrary file read vulnerability in the Simple Download Counter plugin for WordPress. The flaw affects all versions up to and including 2.0. It resides in the simple_download_counter_download_handler function, which fails to properly validate file paths before serving files to the requester.
Authenticated attackers with Author-level access or higher can read arbitrary local files on the server. Sensitive targets include wp-config.php, which contains database credentials and authentication keys, and system files such as /etc/passwd. The weakness is classified under CWE-73: External Control of File Name or Path.
Critical Impact
Authenticated Author-level users can exfiltrate the WordPress configuration file, exposing database credentials and secret keys that enable full site takeover.
Affected Products
- Simple Download Counter plugin for WordPress, all versions through 2.0
- WordPress sites permitting Author-level or higher user registration
- Any hosting environment where the plugin process can read sensitive local files
Discovery Timeline
- 2025-03-01 - CVE-2025-1730 published to the National Vulnerability Database
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2025-1730
Vulnerability Analysis
The vulnerability exists in the simple_download_counter_download_handler handler defined in inc/functions-core.php of the plugin. The handler accepts a user-supplied identifier that resolves to a file path and then streams the file back to the requester. Because the handler does not restrict the resolved path to an allowlisted directory, an authenticated user can coerce it into returning files outside the intended download directory.
An attacker leveraging Author-level access can request the WordPress configuration file wp-config.php. That file contains database credentials, table prefixes, and the AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, and NONCE_KEY values. With those secrets, an attacker can forge session cookies, decrypt stored data, or connect directly to the database if it is reachable.
The vulnerable code paths are documented at lines 328 and 354 of the plugin source. The fix is committed in WordPress Changeset #3247987.
Root Cause
The download handler treats an attacker-controlled parameter as trusted input when constructing the file path passed to the file-read routine. There is no canonicalization or comparison against an allowed base directory. This matches the CWE-73 pattern of external control over a file name or path.
Attack Vector
Exploitation requires an authenticated session with the Author role or higher. The attacker sends a crafted request to the download endpoint that references a target file path on the server. The handler resolves the path and returns the file contents in the HTTP response. Additional analysis is available in the Wordfence Vulnerability Report.
No verified public exploit code has been published for CVE-2025-1730. See the plugin source references above for technical detail on the vulnerable routine.
Detection Methods for CVE-2025-1730
Indicators of Compromise
- HTTP requests to the plugin's download handler containing directory traversal sequences such as ../ or absolute paths like /etc/passwd
- Access log entries showing authenticated Author-level users invoking the download endpoint with unusual identifiers
- Outbound responses from the WordPress site containing strings unique to wp-config.php, such as DB_PASSWORD or AUTH_KEY
- Newly registered Author accounts followed shortly by download handler requests
Detection Strategies
- Inspect web server access logs for requests to the Simple Download Counter download handler where parameters reference paths outside the plugin's upload directory
- Correlate authenticated WordPress session events with file download activity to identify Author-role accounts issuing anomalous download requests
- Deploy web application firewall rules that block traversal sequences and absolute file paths submitted to plugin endpoints
Monitoring Recommendations
- Alert on any read access to wp-config.php performed by the PHP process outside of application initialization
- Track creation of Author-level or higher accounts and flag those that immediately access plugin-managed download endpoints
- Monitor for outbound HTTP responses containing sensitive markers such as database credentials or private key material
How to Mitigate CVE-2025-1730
Immediate Actions Required
- Update the Simple Download Counter plugin to a version above 2.0 that includes Changeset #3247987
- Audit WordPress user accounts and remove or downgrade any unnecessary Author-level or higher accounts
- Rotate database credentials and all WordPress secret keys in wp-config.php if the plugin was installed and accessible
- Review access logs for the download handler to identify prior exploitation attempts
Patch Information
The vendor has published a fix in WordPress Changeset #3247987. Site administrators should apply the update through the WordPress plugin manager or by deploying the patched plugin package. Additional context is available in the Wordfence Vulnerability Report.
Workarounds
- Deactivate and remove the Simple Download Counter plugin until the patched version is installed
- Restrict new user registration and require administrator approval before assigning Author or higher roles
- Apply file system permissions that prevent the web server user from reading wp-config.php beyond what is strictly required, using techniques such as moving wp-config.php one directory above the web root
- Deploy web application firewall rules that block path traversal patterns targeting WordPress plugin endpoints
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
