Cyber Posture

CVE-2025-15364

High

Published: 06 January 2026

Published
06 January 2026
Modified
15 April 2026
KEV Added
Patch
CVSS Score 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0006 17.8th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-15364 is a high-severity Missing Support for Integrity Check (CWE-353) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 17.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068) and 3 other techniques.
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-353

Irrefutable evidence of actions requires integrity protection to prevent tampering or alteration of records.

addresses: CWE-353

Implements required signature-based integrity verification, addressing missing support for integrity checks on components.

addresses: CWE-353

Requiring control over the integrity of all changes directly compels developers to implement integrity verification mechanisms rather than omitting them.

addresses: CWE-353

Tamper detection fundamentally depends on integrity-checking capabilities that this control mandates or strengthens.

addresses: CWE-353

Explicitly requires support for integrity and authenticity checks on components before acceptance into the system.

addresses: CWE-353

Supplies the integrity-check artifacts (e.g., RRSIG, DNSKEY) that were previously missing for DNS responses.

addresses: CWE-353

Control explicitly adds support for integrity mechanisms such as checksums during preparation, preventing attacks that rely on missing integrity checks.

addresses: CWE-353

Directly supplies the missing integrity verification mechanism the weakness describes.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1078 Valid Accounts Stealth
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
T1098 Account Manipulation Persistence
Adversaries may manipulate accounts to maintain and/or elevate access to victim systems.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Directly enables unauthenticated remote exploitation of a public-facing WordPress plugin (T1190) to perform unauthorized account modifications (T1098) resulting in valid account takeover (T1078) and privilege escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

The Download Manager plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.3.40. This is due to the plugin not properly validating a user's identity prior to updating their details like…

more

password. This makes it possible for unauthenticated attackers to change user's passwords, except administrators, and leverage that to gain access to their account.

Deeper analysisAI

CVE-2025-15364 is a privilege escalation vulnerability via account takeover in the Download Manager plugin for WordPress, affecting all versions up to and including 3.3.40. The issue stems from the plugin failing to properly validate a user's identity before updating their details, such as passwords, mapped to CWE-353 (Missing Support for Integrity Check). It carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and was published on 2026-01-06.

Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no user interaction required. By leveraging the flawed validation, they can change passwords for non-administrator user accounts, enabling full account takeover and unauthorized access to those accounts.

Advisories and references point to the root cause in the plugin's Crypt.php file at line 18, with a fix applied in changeset 3431915. Additional details are available in Wordfence's threat intelligence report.

Details

CWE(s)

Affected Products

Wordpress
inferred from references and description; NVD did not file a CPE for this CVE

CVEs Like This One

CVE-2026-3856Shared CWE-353
CVE-2026-42428Shared CWE-353

References