CVE-2025-14399
CSRF in WordPress Download Plugins and Themes Plugin Allows Unauthorized Archiving
Publication date: 2025-12-17
Last updated on: 2025-12-17
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wpfactory | download_plugins_and_themes_from_dashboard | 1.9.7 |
| wpfactory | download_plugins_and_themes_from_dashboard | 1.9.6 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Request Forgery (CSRF) issue in the WordPress plugin 'Download Plugins and Themes from Dashboard' versions up to and including 1.9.6. It occurs because the plugin's bulk download functions for plugins and themes (download_plugin_bulk and download_theme_bulk) lack proper nonce validation. This allows an attacker to trick a site administrator into performing an unwanted action, such as downloading and archiving all plugins and themes into the wp-content/uploads/ directory via a forged request. [2]
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can cause an administrator to unknowingly archive all the site's plugins and themes into the uploads directory. While this does not directly compromise site confidentiality or availability, it can lead to unauthorized actions being performed on the site, potentially exposing plugin and theme files or causing administrative confusion. The vulnerability requires tricking an admin into clicking a malicious link, so social engineering is involved. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves checking if the WordPress site is running the Download Plugins and Themes from Dashboard plugin version 1.9.6 or earlier, which lacks nonce verification on bulk download functions. You can inspect HTTP requests to the admin dashboard for suspicious POST requests to endpoints related to download_plugin_bulk or download_theme_bulk without proper nonce tokens. For example, using curl to simulate or check requests: curl -I -X POST https://yourwordpresssite.com/wp-admin/admin-ajax.php?action=download_plugin_bulk -d 'nonce=invalid' to see if the request is accepted. Additionally, reviewing server logs for unexpected bulk download requests or unusual file creation in wp-content/uploads/ may help detect exploitation attempts. [2]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the Download Plugins and Themes from Dashboard plugin to version 1.9.7 or later, which includes nonce verification and user capability checks to prevent CSRF attacks. Until the update is applied, restrict access to the WordPress admin dashboard to trusted users only and monitor for suspicious activity. Additionally, consider disabling or restricting the plugin's bulk download features if possible, and ensure regular backups of your site to recover from any potential compromise. [2]