CVE-2025-15364
Published: 06 January 2026
Summary
CVE-2025-15364 is a high-severity Missing Support for Integrity Check (CWE-353) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 17.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Irrefutable evidence of actions requires integrity protection to prevent tampering or alteration of records.
Implements required signature-based integrity verification, addressing missing support for integrity checks on components.
Requiring control over the integrity of all changes directly compels developers to implement integrity verification mechanisms rather than omitting them.
Tamper detection fundamentally depends on integrity-checking capabilities that this control mandates or strengthens.
Explicitly requires support for integrity and authenticity checks on components before acceptance into the system.
Supplies the integrity-check artifacts (e.g., RRSIG, DNSKEY) that were previously missing for DNS responses.
Control explicitly adds support for integrity mechanisms such as checksums during preparation, preventing attacks that rely on missing integrity checks.
Directly supplies the missing integrity verification mechanism the weakness describes.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Directly enables unauthenticated remote exploitation of a public-facing WordPress plugin (T1190) to perform unauthorized account modifications (T1098) resulting in valid account takeover (T1078) and privilege escalation (T1068).
NVD Description
The Download Manager plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.3.40. This is due to the plugin not properly validating a user's identity prior to updating their details like…
more
password. This makes it possible for unauthenticated attackers to change user's passwords, except administrators, and leverage that to gain access to their account.
Deeper analysisAI
CVE-2025-15364 is a privilege escalation vulnerability via account takeover in the Download Manager plugin for WordPress, affecting all versions up to and including 3.3.40. The issue stems from the plugin failing to properly validate a user's identity before updating their details, such as passwords, mapped to CWE-353 (Missing Support for Integrity Check). It carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and was published on 2026-01-06.
Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no user interaction required. By leveraging the flawed validation, they can change passwords for non-administrator user accounts, enabling full account takeover and unauthorized access to those accounts.
Advisories and references point to the root cause in the plugin's Crypt.php file at line 18, with a fix applied in changeset 3431915. Additional details are available in Wordfence's threat intelligence report.
Details
- CWE(s)