What’s Vulnerable › Vulnerabilities

CVE-2025-6586: Download Plugin <= 2.2.8 - Authenticated (Administrator+) Arbitrary File Upload

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-04 · updated 2026-06-17
• Weakness: CWE-434

Description

The Download Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the dpwap_plugin_locInstall function in all versions up to, and including, 2.2.8. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Affected products

• metagauss Download Plugin: before 2.2.9 — fixed in 2.2.9

How to fix

Upgrade to a fixed version: metagauss Download Plugin 2.2.9. Check the vendor advisory for mitigations.

References

• https://github.com/d0n601/CVE-2025-6586
• https://plugins.trac.wordpress.org/browser/download-plugin/tags/2.2.8/app/Plugins/Dpwapuploader.php#L300
• https://ryankozak.com/posts/cve-2025-6586/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/37734c25-cce3-41fb-babf-714ba7a4bced?source=cve
• https://github.com/d0n601/CVE-2025-6586
• https://ryankozak.com/posts/cve-2025-6586/

Get alerted when CVE-2025-6586 or the next vulnerability affects your stack