PT-2025-45551

CVE-2025-12177

·

Published

2025-11-07

·

Updated

2025-11-08

Description by

CVSS 3.1
5.3
Medium
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions WordPress Download Manager plugin versions prior to 3.3.31
Description The WordPress Download Manager plugin contains a flaw due to a hardcoded Cron key used in the deleteExpired() and clearTempDataCPCron() functions. This allows unauthenticated attackers to trigger these cron jobs, potentially leading to the deletion of expired posts and clearing of the cache.
Recommendations Update to version 3.3.31 or later.
Exploitability
Fix
Researchers
Vendors
Affected products
Weakness enumeration
CWE-321: Use of Hard-coded Cryptographic Key
Related identifiers
CVE-2025-12177
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com