CVE-2025-4798 is a vulnerability classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) affecting the WP-DownloadManager plugin for WordPress, developed by gamerz. The vulnerability exists in all versions up to and including 1.68.10. It stems from a lack of proper directory restrictions when administrators select storage locations for downloadable files. This design flaw allows any authenticated user with Administrator-level privileges or higher to arbitrarily read any file on the hosting server, including critical system files and configuration data. The attack vector is network-based, requiring no user interaction but necessitating elevated privileges (administrator access). The vulnerability does not impact integrity or availability but poses a significant confidentiality risk by exposing sensitive information that could facilitate further attacks or data breaches. Although no public exploits have been reported, the vulnerability's presence in a widely used WordPress plugin makes it a concern for many organizations. The CVSS v3.1 score of 4.9 reflects the medium severity, balancing the high privilege requirement against the potential impact of data exposure. The vulnerability was published on June 11, 2025, and no patches or mitigations have been officially released at the time of this report.

The primary impact of CVE-2025-4798 is the unauthorized disclosure of sensitive information stored on the web server hosting WordPress sites using the WP-DownloadManager plugin. Attackers with administrator access can read arbitrary files, including system configuration files, database credentials, private keys, and other sensitive data. This exposure can lead to further compromise, such as privilege escalation, lateral movement, or data exfiltration. Organizations relying on this plugin risk leakage of confidential business information, user data, and intellectual property. Although exploitation requires administrator privileges, insider threats or compromised admin accounts can leverage this vulnerability to deepen their access. The impact is particularly significant for organizations with sensitive data hosted on WordPress sites, including e-commerce, healthcare, finance, and government sectors. The vulnerability does not directly affect system integrity or availability but can indirectly facilitate more severe attacks if exploited.

To mitigate CVE-2025-4798, organizations should implement the following specific measures: 1) Immediately restrict administrator access to trusted personnel only, enforcing strong authentication methods such as multi-factor authentication (MFA) to reduce the risk of compromised admin accounts. 2) Monitor and audit administrator activities for unusual file access patterns or attempts to download files outside expected directories. 3) Limit the directories available for download storage through manual configuration or by applying custom access controls at the web server or filesystem level to prevent arbitrary directory selection. 4) Employ web application firewalls (WAFs) with rules designed to detect and block suspicious file read requests targeting the plugin’s download functionality. 5) Regularly back up WordPress sites and configurations to enable recovery in case of compromise. 6) Stay alert for official patches or updates from the plugin vendor and apply them promptly once released. 7) Consider isolating WordPress instances or running them with least privilege principles to minimize the impact of any compromise. 8) Educate administrators about the risks of this vulnerability and the importance of secure handling of plugin configurations.