CVE-2025-4799: WP-DownloadManager File Deletion Vulnerability

CVE-2025-4799 Overview

CVE-2025-4799 is an arbitrary file deletion vulnerability in the WP-DownloadManager plugin for WordPress. The flaw affects all versions up to and including 1.68.10. The plugin fails to restrict the directory from which a file can be deleted. Authenticated attackers with Administrator-level access or above can delete arbitrary files on the server. Deleting sensitive files such as wp-config.php can lead to remote code execution. This vulnerability can be chained with CVE-2025-4798 to delete any file within the WordPress root directory. The weakness is categorized under [CWE-36] (Absolute Path Traversal).

Critical Impact
Authenticated administrators can delete arbitrary files on the server, including wp-config.php, which can be leveraged to achieve remote code execution on the underlying WordPress host.

Affected Products

WP-DownloadManager plugin for WordPress (all versions through 1.68.10)
WordPress sites with the plugin installed and activated
Hosts where the WordPress process can write or unlink files outside the plugin directory

Discovery Timeline

2025-06-11 - CVE-2025-4799 published to the National Vulnerability Database (NVD)
2025-07-09 - Last updated in NVD database

Technical Details for CVE-2025-4799

Vulnerability Analysis

The WP-DownloadManager plugin exposes administrative functionality that accepts a file path parameter and invokes a delete operation without validating that the path remains within the plugin's expected download directory. Because no canonicalization or directory allow-listing occurs, an attacker can supply an absolute or traversal-based path and remove files anywhere the web server user can write.

Deletion of wp-config.php triggers WordPress's installation routine on the next request. An attacker can then point the site to a database under their control and execute arbitrary PHP through the plugin or theme installer, achieving remote code execution.

While the privilege requirement is high (Administrator), the impact extends beyond a single site. In multisite environments, super administrator compromise or stolen administrative credentials makes this issue directly exploitable. Chaining with CVE-2025-4798 broadens the deletable file set to the entire WordPress root directory.

Root Cause

The root cause is missing path validation in the plugin's file management routines referenced in download-manager.php and download-options.php. The code passes user-controlled input to filesystem deletion functions without ensuring the resolved path is confined to an allowed base directory. See the WordPress Plugin Code Review and the WordPress Download Options Code for the vulnerable lines.

Attack Vector

Exploitation requires authenticated access at the Administrator level or higher. The attacker sends a request to the plugin's administrative endpoint with a crafted file path parameter pointing at a sensitive WordPress file. The server resolves the path and unlinks the target file. The request occurs over the network through the WordPress admin interface and requires no user interaction.

The vulnerability is described in prose because no public proof-of-concept code is provided in the advisory. Refer to the Wordfence Vulnerability Advisory for additional technical details.

Detection Methods for CVE-2025-4799

Indicators of Compromise

Unexpected deletion or absence of wp-config.php, .htaccess, or core WordPress files on hosts running WP-DownloadManager.
WordPress installation prompt appearing on a previously configured site, indicating wp-config.php was removed.
Web server access logs showing administrator-authenticated POST requests to WP-DownloadManager admin endpoints with file path parameters.
New PHP files, themes, or plugins created shortly after a wp-config.php deletion event.

Detection Strategies

Monitor filesystem events for unlink() operations on WordPress core files originating from the PHP-FPM or web server process.
Inspect WordPress audit logs for plugin actions performed by administrator accounts targeting WP-DownloadManager endpoints.
Review web server logs for requests to download-options.php and download-manager.php containing path traversal sequences such as ../ or absolute paths.

Monitoring Recommendations

Enable file integrity monitoring on the WordPress root directory, with priority on wp-config.php, .htaccess, index.php, and wp-load.php.
Alert on administrator login activity from new IP addresses or geographies, since the vulnerability requires authenticated administrator access.
Track plugin version inventory across WordPress fleets to identify hosts still running WP-DownloadManager 1.68.10 or earlier.

How to Mitigate CVE-2025-4799

Immediate Actions Required

Update WP-DownloadManager to the version released in WordPress Changeset #3294467, which addresses the deletion path validation.
If patching is not immediately possible, deactivate and remove the WP-DownloadManager plugin until the update is applied.
Audit administrator accounts and rotate credentials for any account that may have been compromised, since exploitation requires administrator privileges.
Restore wp-config.php and other core files from backup if integrity checks indicate tampering.

Patch Information

The vendor released a fix tracked in WordPress Changeset #3294467. Site operators should upgrade to the patched release distributed through the WordPress plugin repository. Verify the installed version is later than 1.68.10 after the update.

Workarounds

Restrict the Administrator role to a minimal set of trusted users and enforce multi-factor authentication on those accounts.
Apply web application firewall rules that block path traversal sequences and absolute paths in requests to WP-DownloadManager admin endpoints.
Set filesystem permissions so the web server user cannot delete wp-config.php and other critical files outside the plugin's working directory.
Disable file editing from the WordPress dashboard by setting DISALLOW_FILE_MODS to true in wp-config.php where operationally feasible.