CVE-2025-12177 is a vulnerability in the codename065 Download Manager WordPress plugin caused by the use of a hardcoded cryptographic key (CWE-321) in the deleteExpired() and clearTempDataCPCron() functions. This key is used to authorize cron job execution, but because it is hardcoded and exposed, unauthenticated attackers can invoke these cron jobs remotely. The impact is limited to unauthorized triggering of maintenance tasks that delete expired posts and clear cache data. The vulnerability affects all versions up to 3.3.30 and has a CVSS v3.1 base score of 5.3 (medium severity). No known exploits in the wild have been reported, and no patch or official fix has been documented.

The vulnerability allows unauthenticated attackers to trigger specific cron jobs that delete expired posts and clear cache data within the Download Manager plugin. This can lead to unintended data deletion and cache clearing, potentially disrupting normal plugin operation and content availability. There is no direct confidentiality or availability impact beyond these effects, and no known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the affected cron job endpoints if possible to prevent unauthorized triggering. Monitor vendor communications for updates regarding patches or official mitigations.