CVE-2025-60093: Download Manager CSRF Vulnerability

CVE-2025-60093 Overview

CVE-2025-60093 is a Cross-Site Request Forgery (CSRF) vulnerability in the Shahjada Download Manager plugin for WordPress. The flaw affects all plugin versions up to and including 3.3.24. An attacker can trick an authenticated user into submitting a forged request that performs unintended state-changing actions within the plugin.

The vulnerability is classified under [CWE-352] and requires user interaction to exploit. It carries a CVSS 3.1 base score of 4.3, with limited integrity impact and no confidentiality or availability impact.

Critical Impact
An attacker can coerce an authenticated WordPress user into executing unauthorized actions in the Download Manager plugin by visiting a malicious page.

Affected Products

Shahjada Download Manager plugin for WordPress
All versions up to and including 3.3.24
WordPress sites with the plugin installed and active

Discovery Timeline

2025-09-26 - CVE-2025-60093 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60093

Vulnerability Analysis

The Download Manager plugin fails to validate the origin of state-changing HTTP requests. Because the plugin does not enforce anti-CSRF tokens (WordPress nonces) or referrer validation on sensitive endpoints, an attacker can craft a request that a logged-in administrator or privileged user unknowingly submits.

Exploitation requires the victim to visit a page controlled by the attacker while authenticated to the target WordPress site. The forged request executes with the victim's session privileges, leading to unauthorized modifications inside the plugin.

The EPSS probability for CVE-2025-60093 is 0.131%, reflecting a low likelihood of exploitation in the near term. However, CSRF flaws targeting WordPress administrators remain a common vector in mass phishing and watering-hole campaigns against publishing platforms.

Root Cause

The root cause is missing or insufficient CSRF protection on sensitive plugin request handlers. WordPress provides wp_nonce_field() and check_admin_referer() primitives, but the vulnerable code paths in Download Manager 3.3.24 and earlier do not consistently apply these controls to state-changing operations.

Attack Vector

The attack is network-based, requires low complexity, and does not require attacker authentication. The exploit does require user interaction — a privileged user must load attacker-controlled content in the same browser session used to administer the WordPress site.

The vulnerability manifests when a forged HTML form or JavaScript-driven request auto-submits against an unprotected plugin endpoint. See the Patchstack Vulnerability Analysis for endpoint-level technical details.

Detection Methods for CVE-2025-60093

Indicators of Compromise

Unexpected changes to Download Manager configuration, files, or settings without corresponding audit log entries from an administrator session.
HTTP POST requests to wp-admin Download Manager endpoints containing external Referer headers.
Administrator account activity originating from unusual IP addresses shortly after visiting third-party websites.

Detection Strategies

Monitor WordPress access logs for requests to plugin administrative endpoints missing valid nonce parameters.
Correlate browser referrer headers on admin-area POST requests to identify cross-origin submissions.
Alert on plugin file or setting modifications performed outside of a documented change window.

Monitoring Recommendations

Enable WordPress audit logging plugins to record all administrative state changes with user, IP, and timestamp context.
Forward web server access logs to a centralized SIEM for correlation with endpoint browsing telemetry.
Track failed and successful admin actions to detect anomalies immediately after user-interaction phishing attempts.

How to Mitigate CVE-2025-60093

Immediate Actions Required

Update the Download Manager plugin to a version later than 3.3.24 as soon as a patched release is available.
Require administrators to log out of WordPress sessions when browsing untrusted content or use a dedicated admin browser profile.
Review recent plugin configuration changes and revert any that cannot be attributed to a legitimate administrator action.

Patch Information

Refer to the Patchstack Vulnerability Analysis for the latest patched version and vendor remediation guidance. Apply the fixed version through the WordPress plugin updater once released by the vendor.

Workarounds

Deploy a web application firewall (WAF) rule that requires valid Origin and Referer headers on requests to Download Manager admin endpoints.
Restrict access to wp-admin by IP allowlist to reduce the attack surface for authenticated CSRF exploitation.
Temporarily deactivate the Download Manager plugin on high-value WordPress sites until a patched release is installed.

bash

# Example nginx WAF snippet to block cross-origin POSTs to wp-admin
location ~* ^/wp-admin/.*\.php$ {
    if ($request_method = POST) {
        set $csrf_block "0";
        if ($http_referer !~* "^https?://your-wordpress-domain\.com/") {
            set $csrf_block "1";
        }
        if ($csrf_block = "1") { return 403; }
    }
}