CVE-2025-4798: WP-DownloadManager Information Disclosure

CVE-2025-4798 Overview

The WP-DownloadManager plugin for WordPress contains an arbitrary file read vulnerability affecting all versions up to and including 1.68.10. This vulnerability exists due to a lack of restriction on the directory an administrator can select for storing downloads, enabling authenticated attackers with Administrator-level access to download and read any file on the server, including sensitive system and configuration files.

Critical Impact

Authenticated attackers with administrator privileges can read arbitrary files from the server, potentially exposing sensitive configuration data, credentials, and system files.

Affected Products

• WP-DownloadManager plugin for WordPress versions up to and including 1.68.10
• WordPress installations running vulnerable versions of WP-DownloadManager

Discovery Timeline

• June 11, 2025 - CVE-2025-4798 published to NVD
• July 9, 2025 - Last updated in NVD database

Technical Details for CVE-2025-4798

Vulnerability Analysis

This arbitrary file read vulnerability stems from insufficient access controls within the WP-DownloadManager plugin's download directory configuration functionality. The plugin fails to properly validate or restrict the directory paths that an administrator can configure for storing downloadable files. This oversight allows a malicious or compromised administrator account to configure the download directory to point to sensitive system locations outside the intended WordPress installation directory.

Once the download directory is configured to point to a sensitive location such as /etc/ or the WordPress root directory, the attacker can leverage the plugin's legitimate download functionality to read arbitrary files from those locations. This can expose critical system files like /etc/passwd, WordPress configuration files containing database credentials (wp-config.php), and other sensitive data that should not be accessible through the web interface.

Root Cause

The root cause of this vulnerability is the absence of proper path validation and directory traversal protection in the download-options.php file. The plugin accepts user-supplied directory paths without verifying that they remain within acceptable boundaries. According to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), this type of information disclosure vulnerability occurs when an application fails to properly restrict access to sensitive resources.

Attack Vector

The attack vector requires network access and authenticated administrator-level privileges. An attacker who has compromised an administrator account or is a malicious insider with admin access can exploit this vulnerability through the following method:

1. Log in to the WordPress admin panel with administrator credentials
2. Navigate to the WP-DownloadManager plugin settings
3. Modify the download directory configuration to point to a sensitive system path
4. Use the download functionality to retrieve arbitrary files from the configured directory

The vulnerability is exploited through the plugin's download options configuration interface, where the lack of directory path restrictions allows pointing to sensitive locations. For detailed technical analysis, refer to the Wordfence Vulnerability Analysis and the relevant WordPress plugin source code.

Detection Methods for CVE-2025-4798

Indicators of Compromise

• Unexpected changes to WP-DownloadManager download directory settings in the WordPress database
• Administrator-initiated downloads of files outside the standard WordPress upload directories
• Access to sensitive system files like /etc/passwd, /etc/shadow, or wp-config.php through the download functionality
• Unusual file access patterns in web server logs originating from the download manager endpoints

Detection Strategies

• Monitor WordPress admin activity logs for changes to WP-DownloadManager plugin configuration
• Implement file integrity monitoring on critical configuration files such as wp-config.php
• Review web server access logs for unusual file download patterns or access to system directories
• Deploy web application firewalls (WAF) with rules to detect path traversal attempts in plugin parameters

Monitoring Recommendations

• Enable WordPress audit logging to track all administrator-level configuration changes
• Configure alerts for modifications to plugin settings, particularly download directory paths
• Implement real-time monitoring for access attempts to sensitive system files
• Review administrator account activity regularly for signs of compromise

How to Mitigate CVE-2025-4798

Immediate Actions Required

• Update WP-DownloadManager to the latest patched version immediately
• Review current WP-DownloadManager configuration to ensure download directories are set appropriately
• Audit administrator accounts for any unauthorized or suspicious activity
• Verify that no sensitive files have been accessed through the download functionality

Patch Information

The vendor has released a security patch addressing this vulnerability. The fix is available in WordPress Changeset #3294467. Users should update to the latest version of WP-DownloadManager through the WordPress plugin update mechanism or by manually downloading the patched version from the WordPress plugin repository.

Workarounds

• Restrict administrator access to trusted users only and implement strong authentication mechanisms
• Apply the principle of least privilege by limiting the number of users with administrator access
• Consider temporarily disabling the WP-DownloadManager plugin until the update can be applied
• Implement server-level restrictions to prevent the web server from accessing sensitive system directories

# Verify WP-DownloadManager plugin version
wp plugin list --name=wp-downloadmanager --fields=name,version,update_version

# Update WP-DownloadManager to latest version
wp plugin update wp-downloadmanager

# Review download manager configuration
wp option get download_manager_options