CVE-2025-15364 is a privilege escalation vulnerability in the codename065 Download Manager WordPress plugin. The flaw arises from inadequate validation of user identity when updating account details, specifically passwords. This allows unauthenticated attackers to change passwords of users other than administrators, effectively taking over those accounts. The vulnerability is identified as CWE-353 (missing support for integrity checks). It affects all versions up to 3.3.40. The CVSS 3.1 base score is 7.3, with attack vector network, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

An attacker can perform privilege escalation by changing passwords of non-administrator users without authentication, leading to unauthorized account takeover. This compromises user confidentiality, integrity, and availability of affected accounts. Administrator accounts are not vulnerable to this attack vector. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the plugin or disabling it if possible. Monitoring for suspicious account changes and applying principle of least privilege to user roles may help reduce risk. Avoid using affected versions of the plugin in production environments if feasible.