BaseFortify

Publication date: 2025-11-08

Last updated on: 2025-11-12

Assigner: Wordfence

Description

The Download Manager plugin for WordPress is vulnerable to unauthorized access due to a hardcoded Cron key used in the deleteExpired() and clearTempDataCPCron() functions in all versions up to, and including, 3.3.30. This makes it possible for unauthenticated attackers to trigger these cron jobs leading to deletion of expired posts and clearing cache.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-08

Last Modified

2025-11-12

Generated

2026-07-06

AI Q&A

2025-11-08

EPSS Evaluated

2026-07-05

NVD

CVE-2025-12177

Affected Vendors & Products

Vendor	Product	Version / Range
wordpress	download_manager	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-321	The product uses a hard-coded, unchangeable cryptographic key.

Attack-Flow Graph

Executive Summary

The vulnerability in the Download Manager plugin for WordPress is due to a hardcoded Cron key used in certain functions (deleteExpired() and clearTempDataCPCron()). This allows unauthenticated attackers to trigger these cron jobs, which can delete expired posts and clear cache without authorization.

Impact Analysis

This vulnerability can allow unauthorized attackers to delete expired posts and clear cache on a WordPress site using the Download Manager plugin. This could lead to loss of data or disruption of site functionality.

Hi! I’m here to help you understand CVE-2025-12177. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70