CVE-2025-30910: CM Download Manager Path Traversal Flaw

CVE-2025-30910 Overview

CVE-2025-30910 is a path traversal vulnerability in the CreativeMindsSolutions CM Download Manager plugin for WordPress. The flaw allows unauthenticated attackers to delete arbitrary files on the server by manipulating file path inputs. The vulnerability affects all versions of cm-download-manager up to and including 2.9.6.

The issue is classified under CWE-22, Improper Limitation of a Pathname to a Restricted Directory. Successful exploitation can disrupt site availability by removing critical files such as wp-config.php, which can force WordPress into an installation state attackers can leverage for site takeover.

Critical Impact
Unauthenticated remote attackers can delete arbitrary files on affected WordPress installations, leading to denial of service and potential site compromise.

Affected Products

CreativeMindsSolutions CM Download Manager plugin for WordPress
Versions from initial release through 2.9.6
WordPress sites with the cm-download-manager plugin installed and activated

Discovery Timeline

2025-04-01 - CVE CVE-2025-30910 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-30910

Vulnerability Analysis

The vulnerability resides in file-handling logic within the CM Download Manager plugin. The plugin accepts a user-supplied filename or path parameter and passes it to a file deletion routine without sufficient validation. Attackers can supply directory traversal sequences such as ../ to escape the intended directory and target files anywhere the PHP process has write access.

Because the affected endpoint requires no authentication, any remote actor can issue the malicious request. The attack scope is changed (S:C), meaning impact extends beyond the vulnerable component to the broader WordPress installation. The primary impact is on availability, with high impact when critical files are removed.

Root Cause

The plugin fails to canonicalize and validate file paths supplied through HTTP request parameters. Input sanitization does not strip or reject ../ sequences, absolute paths, or null bytes before constructing the target path passed to filesystem deletion functions such as unlink().

Attack Vector

Exploitation occurs over the network through standard HTTP(S) requests against a vulnerable WordPress endpoint exposed by the plugin. The attacker submits a crafted request containing a traversal payload in the file parameter. The web server, running as the PHP/Apache user, deletes the targeted file. Removing wp-config.php triggers the WordPress setup flow, which an attacker can complete to seize administrative control. See the Patchstack Vulnerability Report for full technical details.

Detection Methods for CVE-2025-30910

Indicators of Compromise

HTTP requests to CM Download Manager endpoints containing ../, ..%2f, or URL-encoded traversal sequences in file parameters
Unexpected deletion of files such as wp-config.php, .htaccess, or core WordPress files
WordPress installations reverting to the initial setup wizard without administrator action
Web server error logs showing missing-file errors after suspicious plugin requests

Detection Strategies

Inspect web server access logs for requests to cm-download-manager plugin paths containing path traversal patterns
Deploy web application firewall (WAF) rules that block traversal sequences in query strings and POST bodies targeting WordPress plugins
Monitor file integrity on WordPress document roots to identify unauthorized deletions of PHP and configuration files

Monitoring Recommendations

Enable file integrity monitoring (FIM) on wp-content/plugins/, wp-config.php, and the WordPress core directory
Forward WordPress and web server logs to a SIEM and alert on traversal indicators combined with cm-download-manager URI patterns
Track plugin inventory across managed WordPress sites to surface installations still running version 2.9.6 or earlier

How to Mitigate CVE-2025-30910

Immediate Actions Required

Identify all WordPress sites running CM Download Manager and inventory plugin versions
Update CM Download Manager to a version newer than 2.9.6 once a fixed release is published by the vendor
Deactivate and remove the plugin if a patched version is not yet available and the functionality is not business-critical
Restore any deleted files from backups and verify integrity of the WordPress core and configuration

Patch Information

At the time of NVD publication, the vulnerability affects all versions through 2.9.6. Administrators should monitor the Patchstack Vulnerability Report and the plugin page on WordPress.org for an updated release that addresses the path traversal issue.

Workarounds

Block external access to CM Download Manager plugin endpoints using WAF rules until a patched version is deployed
Restrict filesystem permissions so the web server user cannot delete wp-config.php or other critical files
Place the WordPress installation behind authentication or IP allowlisting where feasible to reduce exposure to unauthenticated requests

bash

# Example WAF rule snippet (ModSecurity) to block traversal in plugin requests
SecRule REQUEST_URI "@contains cm-download-manager" \
    "chain,id:1003091,phase:2,deny,status:403,msg:'CVE-2025-30910 traversal attempt'"
    SecRule ARGS "@rx \.\./|\.\.%2f|%2e%2e/" "t:lowercase,t:urlDecodeUni"