CVE-2025-3404: WordPress Download Manager Path Traversal

CVE-2025-3404 Overview

The Download Manager plugin for WordPress contains an arbitrary file deletion vulnerability affecting all versions up to and including 3.3.12. The flaw resides in the savePackage function, which performs insufficient file path validation before deletion operations. Authenticated attackers holding Author-level access or higher can delete arbitrary files on the underlying server. Deletion of sensitive files such as wp-config.php triggers WordPress reinstallation flows, which attackers can leverage to achieve remote code execution. The vulnerability is classified as a path traversal issue under [CWE-22].

Critical Impact
Authenticated users with Author privileges can delete arbitrary server files, enabling remote code execution by removing wp-config.php and hijacking the WordPress reinstallation process.

Affected Products

WordPress Download Manager plugin versions through 3.3.12
WordPress sites permitting Author-level or higher user registration
Multi-author WordPress installations using Download Manager for file distribution

Discovery Timeline

2025-04-19 - CVE-2025-3404 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-3404

Vulnerability Analysis

The Download Manager plugin exposes the savePackage function within src/Admin/Menu/Packages.php to handle package creation and updates. During this workflow, the plugin processes a file path parameter without validating that the target resides within an authorized directory. Attackers supply a relative path containing directory traversal sequences, and the plugin operates on the resolved file outside the intended scope.

Deleting wp-config.php removes the database connection configuration. On the next page load, WordPress treats the site as unconfigured and presents the installation wizard. An attacker completes installation against an attacker-controlled database, gains administrator access, and executes arbitrary PHP through plugin or theme uploads.

Root Cause

The root cause is missing path canonicalization and allowlist validation in the savePackage function. The plugin accepts user-supplied file path input and passes it to filesystem deletion routines without verifying that the resolved path remains within the plugin's package storage directory.

Attack Vector

Exploitation requires an authenticated session with Author-level capabilities or above. The attacker submits a crafted package save request that includes traversal sequences in the file path parameter. The plugin then deletes the targeted file relative to the WordPress root. Refer to the WordPress Download Manager source code and the Wordfence Vulnerability Report for technical details on the vulnerable code paths.

Detection Methods for CVE-2025-3404

Indicators of Compromise

Unexpected deletion of wp-config.php or other core WordPress files in filesystem audit logs
WordPress installation wizard appearing on a previously configured site
HTTP POST requests to Download Manager admin endpoints containing ../ traversal sequences in package parameters
Newly created administrator accounts following Author-level session activity

Detection Strategies

Monitor file integrity for wp-config.php, .htaccess, and index.php within the WordPress root
Inspect web server access logs for requests to wp-admin/admin.php?page=wpdm-packages containing suspicious file path parameters
Correlate Author-level user sessions with filesystem deletion events occurring outside wp-content/uploads/download-manager-files/

Monitoring Recommendations

Enable WordPress audit logging plugins to record package create, update, and delete actions with user attribution
Forward web server and PHP error logs to a centralized SIEM for traversal pattern matching
Alert on any process writing to the WordPress root directory outside scheduled update windows

How to Mitigate CVE-2025-3404

Immediate Actions Required

Update the WordPress Download Manager plugin to a version later than 3.3.12 as soon as the vendor releases a fix
Audit all user accounts with Author-level access or higher and remove unnecessary privileges
Verify wp-config.php integrity and restore from backup if tampering is detected
Review recently created administrator accounts and revoke any that are unauthorized

Patch Information

Review the Wordfence Vulnerability Report for the patched version. Apply the vendor update through the WordPress plugin manager once available. Until the patch is applied, restrict access to the Download Manager admin pages.

Workarounds

Disable the WordPress Download Manager plugin until a patched version is installed
Restrict Author and Editor role registration on public-facing WordPress sites
Apply web application firewall rules that block path traversal sequences in requests to wp-admin/admin.php?page=wpdm-packages
Set the WordPress filesystem to read-only for the web server user where deployment workflows allow

bash

# Restrict write permissions on wp-config.php to prevent deletion by the web server user
chown root:www-data /var/www/html/wp-config.php
chmod 640 /var/www/html/wp-config.php

# Block traversal patterns at the web server (nginx example)
# location ~* /wp-admin/admin\.php { if ($args ~* "\.\./") { return 403; } }