CVE-2025-62734: 
WordPress vulnerability analysis and mitigation

CVE-2025-62734 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Media Library Downloader by Michael Revellin-Clerc (M.Code). It affects all versions up to and including 1.4.0, allowing unauthenticated attackers to forge requests that trick authenticated users into performing unintended actions. The vulnerability was reported by Nabil Irawan on November 4, 2025, and published by Patchstack on December 4, 2025, with NVD publication on December 9, 2025. It carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery), meaning the plugin fails to validate that state-changing requests originate from a legitimate, authenticated session — specifically by not implementing or properly verifying CSRF nonces on sensitive actions (Patchstack). An attacker can craft a malicious web page or link that, when visited by a logged-in WordPress user, silently submits a forged request to the plugin's endpoint on the victim's behalf. Exploitation requires no privileges from the attacker but does require user interaction — specifically, a privileged user must be socially engineered into visiting the attacker-controlled page (Patchstack).

Successful exploitation allows a malicious actor to force higher-privileged WordPress users (e.g., administrators or editors) to execute unwanted actions within the Media Library Downloader plugin under their current authentication context. The primary impact is on integrity (CVSS integrity impact: Low), with no direct confidentiality or availability impact. In practice, this could result in unauthorized modifications to media library download settings or configurations, depending on the plugin's functionality (Patchstack).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-62734. The EPSS score is extremely low at approximately 0.008%, reflecting a very low probability of exploitation in the near term (Feedly). Patchstack classifies this as low priority with no impactful threat, though they note that CSRF vulnerabilities of this type can be leveraged in mass-exploit campaigns targeting WordPress plugins at scale. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify WordPress sites running the Media Library Downloader plugin version ≤ 1.4.0 using tools like WPScan or Shodan with WordPress plugin fingerprinting.
2. Craft malicious payload: Create an HTML page containing a hidden form or JavaScript that auto-submits a forged POST/GET request to the vulnerable plugin endpoint (e.g., a plugin admin action URL) on the target WordPress site.
3. Social engineering: Deliver the malicious link or page to a logged-in WordPress administrator or privileged user via phishing email, comment, or other social engineering vector.
4. Trigger exploitation: When the victim visits the attacker's page while authenticated to the WordPress site, the browser automatically sends the forged request with the victim's session cookies, causing the plugin to execute the unintended action without CSRF token validation.
5. Achieve objective: The plugin performs the attacker-specified action (e.g., modifying download settings) under the victim's privileges (Patchstack).

• Logs: WordPress access logs showing unexpected POST requests to Media Library Downloader plugin admin endpoints from unusual referrer origins or with no referrer header, particularly from non-admin IP addresses.
• Logs: WordPress audit logs (if enabled via a plugin like WP Activity Log) recording plugin configuration changes made by an administrator account at unusual times or without corresponding admin panel activity.
• Network: HTTP requests to /wp-admin/admin-post.php or plugin-specific action URLs with action=media_library_downloader_* parameters originating from external or unexpected referrer domains.

The vendor has released version 1.4.1 of the Media Library Downloader plugin, which patches this vulnerability. WordPress site administrators should update the plugin to version 1.4.1 or later immediately via the WordPress admin dashboard or by downloading the updated plugin from the WordPress plugin repository. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. No configuration-based workaround is available; updating is the only recommended remediation (Patchstack).