CVE-2025-15364 codename065 CVE debrief

Who should care

Defenders responsible for WordPress installations with the Download Manager plugin should assess exposure and risk of account takeover. This includes operators managing WordPress environments, platform administrators, vulnerability management teams, and security teams that need to verify exposure, assess risk, and update to a fixed version if available.

Why it matters

CVE-2025-15364 allows unauthenticated attackers to change user passwords in the Download Manager plugin for WordPress, except administrators. Defenders should verify exposure, assess risk, and update to a fixed version if available.

• Unauthenticated attackers can change user passwords to gain access to accounts
• Except administrators, all user accounts are vulnerable to password changes
• Defenders need to verify exposure of plugin versions up to 3.3.40
• Remediation priority is high due to potential for account takeover

Technical summary

The Download Manager plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.3.40. This is due to the plugin not properly validating a user's identity prior to updating their details like password. This makes it possible for unauthenticated attackers to change user's passwords, except administrators, and leverage that to gain access to their account.

Defensive priority

Defenders should prioritize verifying exposure of the Download Manager plugin versions up to 3.3.40 and assess the risk of account takeover.

Recommended defensive actions

• Verify exposure of the Download Manager plugin versions up to 3.3.40
• Assess the risk of account takeover
• Update to a fixed version if available
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability allows unauthenticated attackers to change user passwords, except administrators, due to improper validation of user identity. This issue exists in all versions up to, and including, 3.3.40 of the Download Manager plugin.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.