CVE-2025-15364

Name of the Vulnerable Software and Affected Versions Download Manager plugin for WordPress versions prior to 3.3.41

Description The Download Manager plugin for WordPress is susceptible to privilege escalation, potentially leading to account takeover. The issue stems from insufficient user identity validation before allowing updates to user details, such as passwords. This allows unauthenticated attackers to modify user passwords—excluding those of administrators—and subsequently gain access to their accounts.

Recommendations Update the Download Manager plugin to version 3.3.41 or later.