CVE-2025-63070: 
WordPress vulnerability analysis and mitigation

CVE-2025-63070 is a Sensitive Data Exposure vulnerability in the WordPress Download Manager plugin by Shahjada, classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere). It affects all versions of the plugin up to and including 3.3.32, and was reported by researcher Que Thanh Tuan on August 31, 2025, with public disclosure on September 30, 2025. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium), requiring low privileges (Subscriber level) to exploit (Patchstack).

The vulnerability is rooted in improper access control (OWASP Top 10: A1 – Broken Access Control), allowing authenticated users with low privileges (e.g., Subscriber role) to retrieve sensitive system information that should be restricted to administrators. Classified as CWE-497, the flaw enables attackers to retrieve embedded sensitive data from the plugin, potentially exposing configuration details or other protected information. The attack vector is network-based, requires no user interaction, and has low attack complexity, making it straightforward to exploit for any authenticated WordPress user (Patchstack).

Successful exploitation allows a low-privileged authenticated attacker to access sensitive information not normally available to regular users, impacting confidentiality with no effect on integrity or availability. While the direct impact is limited to information disclosure, the exposed data could be leveraged to facilitate further attacks against the WordPress installation or its underlying infrastructure. Patchstack notes that vulnerabilities of this type are sometimes used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their size or popularity (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-63070. The EPSS score is approximately 0.035%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority with no impactful threat currently observed (Patchstack).

The vulnerability is patched in WordPress Download Manager version 3.3.33. Site administrators should update the plugin to version 3.3.33 or later immediately. Patchstack users can enable auto-update for vulnerable plugins to automate remediation. If an immediate update is not possible, restricting Subscriber-level user registrations or temporarily disabling the plugin are interim mitigations (Patchstack).