CVE-2021-25087: Wordpress Download Manager < 3.2.25 - Sensitive Information Disclosure

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-03-07 · updated 2026-06-17
Weakness: CWE-862

Description

The Download Manager WordPress plugin before 3.2.35 does not have any authorisation checks in some of the REST API endpoints, allowing unauthenticated attackers to call them, which could lead to sensitive information disclosure, such as posts passwords (fixed in 3.2.24) and files Master Keys (fixed in 3.2.25).

Affected products

codename065 Download Manager: before 3.2.35 — fixed in 3.2.35

How to fix

Upgrade to a fixed version: codename065 Download Manager 3.2.35. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/d7ceafae-65ec-4e05-9ed1-59470771bf07
https://wpscan.com/vulnerability/d7ceafae-65ec-4e05-9ed1-59470771bf07

Get alerted when CVE-2021-25087 or the next vulnerability affects your stack