CVE-2025-15364 - CVE House

Back to Database

Status published High CVE-2025-15364

Download Manager <= 3.3.40 - Unauthenticated Limited Privilege Escalation via updatePassword

7.3 CVSS

Vulnerability Description

The Download Manager plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.3.40. This is due to the plugin not properly validating a user's identity prior to updating their details like password. This makes it possible for unauthenticated attackers to change user's passwords, except administrators, and leverage that to gain access to their account.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-15364

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Drew Webber

References

More from codename065

View All →

Download Manager <= 3.3.18 - Authenticated (Author+) Stored Cross-site Scripting via wpdm_user_dashboard Shortcode

Download Manager <= 3.3.12 - Authenticated (Author+) Arbitrary File Deletion

Download Manager <= 3.3.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

Download Manager <= 3.3.08 - Authenticated (Author+) Path Traversal to Limited File Overwrite

Download Manager <= 3.3.32 - Missing Authorization to Authenticated (Subscriber+) Media Attachment Password Disclosure

Affected Vendor

codename065

View all reports →

Affected Software

Download Manager

Vulnerable Versions:

0

Timeline

Official Publish: January 6th, 2026

Last Modified: April 8th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.