CVE-2025-46519: Media Library Downloader Auth Bypass Flaw

CVE-2025-46519 Overview

CVE-2025-46519 is a missing authorization vulnerability in the M.Code Media Library Downloader plugin for WordPress. The flaw affects all versions of media-library-downloader up to and including 1.3.1. The plugin fails to enforce proper access control checks, allowing authenticated users with low privileges to reach functionality that should be restricted. The issue is classified under [CWE-862] Missing Authorization and stems from incorrectly configured access control security levels.

Critical Impact

Authenticated attackers with minimal privileges can bypass access control checks in the Media Library Downloader plugin and interact with restricted plugin functionality, resulting in unauthorized information exposure.

Affected Products

• M.Code Media Library Downloader plugin for WordPress
• All versions from initial release through 1.3.1
• WordPress sites with the media-library-downloader plugin installed and activated

Discovery Timeline

• 2025-04-24 - CVE-2025-46519 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46519

Vulnerability Analysis

The vulnerability exists in the Media Library Downloader WordPress plugin, which allows administrators to bulk download media assets from the WordPress media library. The plugin exposes actions that lack proper capability checks. An attacker with a low-privilege authenticated account, such as a subscriber, can invoke plugin functionality intended only for administrators.

The root category is broken access control. According to the CVSS vector, the attack occurs over the network with low complexity, requires low privileges, needs no user interaction, and results in a confidentiality impact. Integrity and availability are not affected. The EPSS probability places the vulnerability in the lower range of publicly known issues expected to be exploited in the near term.

Root Cause

The plugin does not verify user capabilities before executing sensitive operations. WordPress plugins are expected to gate privileged actions using current_user_can() checks and nonce validation via check_admin_referer() or wp_verify_nonce(). The Media Library Downloader code paths either omit these checks or apply them inconsistently, which allows any authenticated user to reach protected functions.

Attack Vector

An attacker authenticates to a WordPress site using any valid account, including a self-registered subscriber account on sites with open registration. The attacker then issues HTTP requests to the plugin's endpoints. Because the plugin does not validate authorization, the requests are processed with the plugin's intended privileges. The result is unauthorized read access to media resources or plugin state.

No public proof-of-concept exploit code is available. See the Patchstack WordPress Vulnerability Report for additional technical details.

Detection Methods for CVE-2025-46519

Indicators of Compromise

• Requests to admin-ajax.php or plugin-specific endpoints originating from low-privilege user sessions such as subscriber or contributor accounts
• Unexpected access to wp-admin pages registered by the media-library-downloader plugin from non-administrator users
• Unusual bulk downloads of media files or archive generation activity in WordPress access logs

Detection Strategies

• Audit WordPress user roles and review recent activity for subscriber or low-privilege accounts invoking plugin actions
• Enable WordPress activity logging plugins to record capability-related actions and REST or AJAX requests
• Review web server access logs for repeated requests to Media Library Downloader endpoints from a single authenticated session

Monitoring Recommendations

• Track new user registrations on sites that allow open registration and correlate with plugin endpoint access
• Monitor egress traffic for large or repeated downloads of media archives that do not correspond to legitimate administrative workflows
• Alert on HTTP 200 responses to plugin endpoints from users whose role does not include manage_options or upload_files

How to Mitigate CVE-2025-46519

Immediate Actions Required

• Update the Media Library Downloader plugin to a version later than 1.3.1 once a patched release is published by the vendor
• Deactivate and remove the media-library-downloader plugin if a patched version is not yet available
• Disable open user registration on WordPress sites where it is not required for business functionality

Patch Information

At the time of publication, the Patchstack advisory lists all versions through 1.3.1 as affected. Site administrators should monitor the Patchstack WordPress Vulnerability Report and the plugin's WordPress.org page for a fixed release.

Workarounds

• Restrict access to wp-admin and admin-ajax.php at the web server or WAF layer for non-administrator users
• Apply virtual patching rules through a WordPress security plugin or web application firewall to block unauthorized calls to Media Library Downloader endpoints
• Audit and remove unused low-privilege accounts to reduce the attack surface available for authenticated exploitation

# Example: disable the vulnerable plugin from the WordPress CLI
wp plugin deactivate media-library-downloader
wp plugin delete media-library-downloader