CVE-2025-49995 Overview
CVE-2025-49995 is an Authorization Bypass Through User-Controlled Key vulnerability, also known as Insecure Direct Object Reference (IDOR), in the dFactory Download Attachments plugin for WordPress. The flaw affects all plugin versions up to and including 1.3.1. Unauthenticated attackers can manipulate user-controlled identifiers to access attachments they should not be authorized to retrieve. The weakness maps to CWE-639: Authorization Bypass Through User-Controlled Key. The vulnerability was published to the National Vulnerability Database (NVD) on June 20, 2025.
Critical Impact
Unauthenticated network attackers can bypass access control checks and retrieve restricted attachments from affected WordPress installations, resulting in confidentiality loss.
Affected Products
- dFactory Download Attachments plugin for WordPress
- Versions from n/a through <= 1.3.1
- WordPress sites with the Download Attachments plugin enabled
Discovery Timeline
- 2025-06-20 - CVE-2025-49995 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-49995
Vulnerability Analysis
The Download Attachments plugin exposes attachment retrieval functionality through parameters that reference internal object identifiers. The plugin fails to validate whether the requesting user has authorization to access the referenced attachment. An attacker can substitute the identifier value in a request to point to attachments belonging to other users or protected content.
Because the vulnerability is exploitable over the network without authentication and without user interaction, any anonymous visitor can send crafted HTTP requests to enumerate and retrieve attachments. The impact is limited to confidentiality — attackers cannot modify data or disrupt service through this flaw alone. This category of weakness, IDOR, is a well-known access control failure documented in the OWASP Top 10.
Root Cause
The root cause is missing or improperly configured access control checks on attachment identifiers supplied by the client. The plugin trusts the numeric or string key provided in the request and returns the corresponding attachment without confirming the caller's entitlement. This matches the CWE-639 pattern where authorization decisions rely on client-supplied keys.
Attack Vector
Exploitation requires only HTTP access to the affected WordPress site. An attacker enumerates attachment identifiers by incrementing or fuzzing the vulnerable parameter, then issues download requests directly. No credentials, session, or user interaction are required. Successful requests return attachment content that the attacker would not normally be authorized to view. Refer to the Patchstack Vulnerability Report for additional technical context.
Detection Methods for CVE-2025-49995
Indicators of Compromise
- Sequential or high-volume HTTP requests to Download Attachments plugin endpoints with incrementing attachment identifier parameters
- Successful HTTP 200 responses returning attachment content to unauthenticated sessions
- Unusual outbound transfer volume from wp-content/uploads/ or the plugin's download handler
Detection Strategies
- Review web server access logs for patterns of enumeration against Download Attachments plugin URLs
- Deploy a Web Application Firewall (WAF) rule to flag anonymous requests referencing attachment IDs outside expected ranges
- Correlate requests lacking authentication cookies with successful attachment download responses
Monitoring Recommendations
- Enable WordPress audit logging for attachment access events and export to a centralized logging platform
- Alert on spikes in requests to plugin endpoints from single IP addresses or unusual geographies
- Track user-agent diversity and request cadence to detect automated scraping of protected attachments
How to Mitigate CVE-2025-49995
Immediate Actions Required
- Identify all WordPress sites running the Download Attachments plugin at version 1.3.1 or earlier
- Disable the plugin until a patched version is confirmed available and deployed
- Restrict access to attachment endpoints via authentication or IP allow-listing where feasible
- Rotate or remove sensitive attachments that may have been exposed during the exposure window
Patch Information
At the time of publication, the vendor has not published a fixed release confirmed in the enriched data. Monitor the Patchstack Vulnerability Report and the plugin's WordPress.org listing for a patched release beyond version 1.3.1.
Workarounds
- Uninstall the Download Attachments plugin and serve files through a WordPress core mechanism that enforces capability checks
- Place sensitive attachments behind an authenticated reverse proxy or CDN with signed URLs
- Add server-level access control rules to require authentication for requests to the plugin's download handler
- Apply a virtual patch through a WAF to reject unauthenticated attachment ID enumeration requests
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
