CVE-2025-2048: 
WordPress vulnerability analysis and mitigation

CVE-2025-2048 affects the Lana Downloads Manager WordPress plugin versions before 1.10.0. The vulnerability was discovered and reported by Bruno Oliveira from IncludeSecurity, and was publicly disclosed on March 11, 2025. The vulnerability exists in the plugin's file handling functionality, where it fails to properly validate user input used in file paths (WPScan).

The vulnerability is a path traversal issue that affects the file handling mechanism in the Lana Downloads Manager WordPress plugin. It has been assigned a CVSS v3.1 base score of 4.1 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N. The vulnerability requires high privileges (admin role) to exploit, has network accessibility, and can potentially impact confidentiality through unauthorized file access (NVD).

The vulnerability allows authenticated users with administrative privileges to perform path traversal attacks and download arbitrary files from the server. This could potentially lead to unauthorized access to sensitive server files and information disclosure (WPScan).

The vulnerability can be exploited by authenticated users with administrative access. An attacker can exploit this by logging into the WordPress Administration console, navigating to Downloads -> Add Download, and manipulating the File URL parameter using PHP wrapper techniques such as 'php://filter/resource=' followed by the target file path (WPScan).

Users should upgrade to Lana Downloads Manager version 1.10.0 or later, which contains the fix for this vulnerability (WPScan).