CVE-2025-12177 MEDIUM

CVE-2025-12177: Download Manager <= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron Key

Vendor Codename065
Product Download Manager
Weakness CWE-321
Published November 8, 2025
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

The Download Manager plugin for WordPress is vulnerable to unauthorized access due to a hardcoded Cron key used in the deleteExpired() and clearTempDataCPCron() functions in all versions up to, and including, 3.3.30. This makes it possible for unauthenticated attackers to trigger these cron jobs leading to deletion of expired posts and clearing cache.

Explanation of Vulnerability in Simple Terms

02Summary

Download Manager versions 3.3.30 and earlier contain a flaw that allows attackers to modify data without authentication. The vulnerability requires only network access and no user interaction. Site administrators should update to a version newer than 3.3.30 to prevent unauthorized data tampering.

What an attacker can do

03Attacker Capabilities

Modify data on the site without logging in.

Potential impact on your site

04Site Impact

Attackers can alter files, settings, or content managed by Download Manager without credentials.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

November 8, 2025 CVE published
April 8, 2026 Record updated