CVE-2025-60092: Download Manager Information Disclosure

CVE-2025-60092 Overview

CVE-2025-60092 is a sensitive data exposure vulnerability in the Shahjada Download Manager plugin for WordPress. The flaw is classified under [CWE-497]: Exposure of Sensitive System Information to an Unauthorized Control Sphere. It affects Download Manager versions up to and including 3.3.25.

The vulnerability allows an unauthenticated remote attacker to retrieve embedded sensitive data from the plugin over the network. No authentication or user interaction is required to trigger the disclosure. The issue was disclosed through Patchstack and assigned CVE-2025-60092.

Critical Impact
Unauthenticated network attackers can retrieve embedded sensitive data from WordPress sites running Download Manager <= 3.3.25, aiding follow-on attacks against the affected site.

Affected Products

Shahjada Download Manager plugin for WordPress
Versions from initial release through 3.3.25
WordPress sites with the vulnerable plugin activated

Discovery Timeline

2025-09-26 - CVE-2025-60092 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60092

Vulnerability Analysis

The Download Manager plugin exposes sensitive information to unauthorized callers through a network-accessible interface. Under [CWE-497], the plugin returns data that should be restricted to trusted internal components or authenticated administrators. An unauthenticated remote actor can request this data and receive contents that assist reconnaissance or further exploitation.

The advisory from Patchstack identifies the impact as retrieval of embedded sensitive data. The confidentiality impact is limited, and there is no integrity or availability impact. Attack complexity is low and no privileges are required.

Root Cause

The root cause is missing or insufficient access control on a plugin endpoint or file path that returns embedded sensitive data. The plugin does not properly restrict the control sphere in which the data is served, allowing anonymous requests to reach content intended for authorized users only. See the Patchstack Vulnerability Report for technical specifics.

Attack Vector

Exploitation occurs over the network against the WordPress site hosting the vulnerable plugin. An attacker issues HTTP requests to the exposed plugin resource and parses the response for embedded sensitive information. No credentials, session, or user interaction are required. The EPSS score at time of writing is 0.285% (percentile 20.61), reflecting low current exploitation likelihood but non-zero risk.

Detection Methods for CVE-2025-60092

Indicators of Compromise

Unauthenticated HTTP GET requests to Download Manager plugin paths under /wp-content/plugins/download-manager/ from external IPs.
Repeated anonymous requests scraping plugin-managed resources or configuration files.
HTTP 200 responses that return non-public metadata or content to unauthenticated sessions.

Detection Strategies

Inventory WordPress installations and identify sites running Download Manager <= 3.3.25.
Review web server access logs for unauthenticated access patterns targeting plugin endpoints.
Compare responses served to anonymous requests against expected public content baselines.

Monitoring Recommendations

Alert on spikes in anonymous requests to /wp-content/plugins/download-manager/ paths.
Monitor for external clients enumerating plugin directories or file listings.
Track outbound data volumes from WordPress hosts to unusual destinations following plugin resource requests.

How to Mitigate CVE-2025-60092

Immediate Actions Required

Upgrade Download Manager to a version later than 3.3.25 as soon as the vendor releases a patched build.
Audit the plugin's stored content for sensitive information that may have been exposed prior to patching.
Rotate any credentials, tokens, or keys that were stored within or referenced by the plugin.

Patch Information

Refer to the Patchstack Vulnerability Report for patched version guidance. Apply the vendor-supplied update through the WordPress plugin manager once available and confirm the installed version reports higher than 3.3.25.

Workarounds

Temporarily deactivate the Download Manager plugin until a patched release is installed.
Restrict access to plugin paths at the web server or WAF layer, blocking anonymous requests to sensitive endpoints.
Remove any embedded secrets or sensitive files from plugin-managed storage until remediation is verified.

bash

# Example nginx rule to block anonymous access to plugin paths
location ~* /wp-content/plugins/download-manager/.*\.(php|txt|log|json)$ {
    deny all;
    return 403;
}