CVE-2025-15364
High · 7.3CVSS
7.3
EPSS
0.2%
Published
Jan 6, 2026
CISA due date
—
The record
The Download Manager plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.3.40. This is due to the plugin not properly validating a user's identity prior to updating their details like password. This makes it possible for unauthenticated attackers to change user's passwords, except administrators, and leverage that to gain access to their account.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-89179 WeenyGenius, a computer lab management system by Howyar Technologies, has a Missing… CWE-353
- CVE-2026-58224 A flaw was found in Samba's CTDB, the clustered database service used by Samba. CWE-353
- CVE-2026-17583 The affected Thermo Fisher Applied Biosystems Genetic Analyzers are vulnerable because… CWE-353
- CVE-2026-48995 pnpm is a package manager. CWE-353
- CVE-2026-7574 Anthropic Claude Desktop Cowork VM image handling (confirmed across v1.1348.0 through… CWE-353
- CVE-2026-45787 electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. CWE-353
- GHSA-g29v-q6h7-76wh electerm's encrypt method not safe enough CWE-353
- CVE-2026-42428 OpenClaw versions before 2026.4.8 fail to enforce integrity verification on downloaded… CWE-353