CVE-2025-15364

High

Published: 06 January 2026

Published

06 January 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS Score 0.0002 6.4th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-15364 is a high-severity Missing Support for Integrity Check (CWE-353) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 6.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and IA-11 (Re-authentication).

Deeper analysis

CVE-2025-15364 is a privilege escalation vulnerability via account takeover in the Download Manager plugin for WordPress, affecting all versions up to and including 3.3.40. The issue stems from the plugin failing to properly validate a user's identity before updating their details, such as passwords, mapped to CWE-353 (Missing Support for Integrity Check). It carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and was published on 2026-01-06.

Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no user interaction required. By leveraging the flawed validation, they can change passwords for non-administrator user accounts, enabling full account takeover and unauthorized access to those accounts.

Advisories and references point to the root cause in the plugin's Crypt.php file at line 18, with a fix applied in changeset 3431915. Additional details are available in Wordfence's threat intelligence report.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-1097

Vulnerability details

The Download Manager plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.3.40. This is due to the plugin not properly validating a user's identity prior to updating their details like…

password. This makes it possible for unauthenticated attackers to change user's passwords, except administrators, and leverage that to gain access to their account.

CWE(s): CWE-353

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

T1078 Valid Accounts Stealth

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

attack.mitre.org →

T1098 Account Manipulation Persistence

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems.

attack.mitre.org →

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Directly enables unauthenticated remote exploitation of a public-facing WordPress plugin (T1190) to perform unauthorized account modifications (T1098) resulting in valid account takeover (T1078) and privilege escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1