CVE-2025-13498: 
WordPress vulnerability analysis and mitigation

CVE-2025-13498 is a missing authorization vulnerability in the Download Manager plugin for WordPress, allowing authenticated attackers to access sensitive information. All versions up to and including 3.3.32 are affected. The flaw was published on December 18, 2025, and assigned by Wordfence. It carries a CVSS v3.1 base score of 4.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is missing authorization and capability checks (CWE-862) on the wpdm_media_access AJAX action within the plugin's MediaAccessControl.php file. Because no privilege validation is enforced on this endpoint, any authenticated user with Subscriber-level access or above can invoke the action to retrieve passwords and access control settings for protected media attachments. This effectively allows the attacker to bypass the plugin's intended media protection mechanisms and download restricted files (Wordfence, WordPress Trac).

Successful exploitation results in unauthorized disclosure of passwords and access control settings for protected media attachments, enabling attackers to download files that should be restricted. The confidentiality impact is limited to the scope of protected media managed by the plugin, with no integrity or availability impact. While lateral movement potential is low, exposure of file passwords could facilitate further unauthorized access to sensitive documents hosted on the affected WordPress site (Wordfence).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.028%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a Subscriber-level authenticated account on the target WordPress site, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Obtain authenticated access: Register or obtain credentials for a Subscriber-level (or higher) account on the target WordPress site running Download Manager ≤ 3.3.32.
2. Identify the vulnerable AJAX endpoint: Locate the wpdm_media_access AJAX action, accessible via the standard WordPress AJAX handler at /wp-admin/admin-ajax.php.
3. Craft a malicious AJAX request: Send an authenticated POST request to admin-ajax.php with the action parameter set to wpdm_media_access and the relevant media attachment ID as a parameter.
4. Retrieve sensitive data: Parse the server response to extract the password and access control settings for the targeted protected media attachment.
5. Bypass protection and download files: Use the retrieved password or access control data to authenticate against the protected media and download the restricted file (Wordfence, WordPress Trac).

• Network: Repeated or anomalous POST requests to /wp-admin/admin-ajax.php with action=wpdm_media_access from low-privileged user accounts; unusual download activity for protected media files shortly after such requests.
• Logs: WordPress access logs showing authenticated Subscriber-level users invoking the wpdm_media_access AJAX action in rapid succession or for multiple attachment IDs; unexpected access to protected media download URLs.
• File System: No direct file system artifacts expected, but review server-side download logs for protected media files being accessed by accounts that should not have permission.

Users should update the Download Manager plugin to version 3.3.33 or later, which includes the fix introduced in changeset 3413804 that adds proper authorization and capability checks to the wpdm_media_access AJAX action. As an interim workaround, site administrators can restrict user registration or limit Subscriber-level account creation to reduce the attack surface. Reviewing and auditing existing Subscriber-level accounts for suspicious activity is also recommended (WordPress Trac Changeset, Wordfence).