What is the CVSS score of EUVD-2025-18084?

EUVD-2025-18084 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Wp Downloadmanager are affected by EUVD-2025-18084?

Organizations using for WordPress is vulnerable to arbitrary file read in all should be aware of moderate risk from CVE-2025-4798, a information exposure vulnerability rated CVSS 4.9.. A patch is available.

How to fix or mitigate EUVD-2025-18084?

Within 30 days: Identify affected systems running for WordPress is vulnerable to arbitrary file read in all and apply vendor patches as part of regular patch cycle. Review data exposure and access controls.

Wp Downloadmanager EUVD-2025-18084

| CVE-2025-4798 MEDIUM

Information Exposure (CWE-200)

2025-06-11 security@wordfence.com

WordPress Information Disclosure Wp Downloadmanager PHP

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 21:09 euvd

EUVD-2025-18084

Analysis Generated

Mar 14, 2026 - 21:09 vuln.today

Patch released

Mar 14, 2026 - 21:09 nvd

Patch available

CVE Published

Jun 11, 2025 - 04:15 nvd

MEDIUM 4.9

DescriptionCVE.org

The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.68.10. This is due to a lack of restriction on the directory an administrator can select for storing downloads. This makes it possible for authenticated attackers, with Administrator-level access and above, to download and read any file on the server, including system and configuration files.

Analysis

Technical ContextAI

Information disclosure occurs when an application inadvertently reveals sensitive data to unauthorized actors through error messages, logs, or improper access controls. This vulnerability is classified as Information Exposure (CWE-200).

RemediationAI

A vendor patch is available — apply it immediately. Implement proper access controls. Sanitize error messages in production. Review logging practices to avoid capturing sensitive data.