CVE-2025-49995

Executive Summary

CVE-2025-49995 is an Authorization Bypass Through User-Controlled Key vulnerability in the WordPress plugin "Download Attachments" by Dfactory, affecting versions n/a through 1.3.1. This flaw allows an unauthenticated attacker to manipulate a user-controlled key (likely a download ID or attachment reference) to access or download attachments that should be restricted by access control security levels. The vulnerability is classified as CWE-639: Authorization Bypass Through User-Controlled Key and carries a CVSS score of 5.3 (Medium). No public exploit code or proof-of-concept is currently available, and the vendor has not released a patch. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains for sites using this plugin.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and is installed directly by site administrators. There is no associated NPM, PyPI, Go, or Ruby package. The supply chain risk is limited to the plugin’s update mechanism; since no patch exists, users must manually disable or remove the plugin.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – impact confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – limited access to attachment data.
• Integrity Impact: None (I:N) – no data modification.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: Medium. The vulnerability is easy to exploit but only leads to limited information disclosure (attachment files). No public exploit exists, but the attack surface is significant for WordPress sites using this plugin.

Deep Dive & Mechanics

The vulnerability resides in the Download Attachments plugin’s attachment retrieval mechanism. The plugin likely uses a user-controlled parameter (e.g., ?download_attachment_id=123) to fetch and serve files. Due to insufficient authorization checks, an attacker can enumerate or manipulate this parameter to access attachments that are intended to be restricted (e.g., private or role-based downloads).

Root Cause: The plugin fails to validate whether the current user has the required permissions to access the requested attachment. Instead, it trusts the user-supplied key (attachment ID) without verifying ownership or access control lists.

Attack Flow:

1. Attacker identifies a WordPress site using the vulnerable plugin.
2. Attacker crafts a request to the download endpoint with a manipulated attachment ID.
3. The plugin serves the file without checking if the user is authorized.
4. Attacker downloads sensitive attachments (e.g., private documents, invoices).

Affected Component: The download-attachments plugin’s file download handler (likely in includes/class-download-attachments.php or similar).

Vulnerable vs. Patched Code

Since no official patch exists, the following is a hypothetical comparison based on common fixes for CWE-639.

Vulnerable Code (Conceptual):

// Vulnerable: No authorization check
function download_attachment() {
    $attachment_id = $_GET['attachment_id'];
    $file_path = get_attached_file($attachment_id);
    // Serve file directly
    header('Content-Type: ' . mime_content_type($file_path));
    readfile($file_path);
    exit;
}

Patched Code (Conceptual):

// Patched: Authorization check added
function download_attachment() {
    $attachment_id = $_GET['attachment_id'];
    // Verify user has permission to access this attachment
    if (!current_user_can('read_private_attachments') && !attachment_belongs_to_user($attachment_id)) {
        wp_die('Unauthorized', 403);
    }
    $file_path = get_attached_file($attachment_id);
    header('Content-Type: ' . mime_content_type($file_path));
    readfile($file_path);
    exit;
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with the Download Attachments plugin (version <= 1.3.1) installed and active.
• At least one attachment uploaded (public or private).

Exploitation Steps:

1. Enumerate attachment IDs by observing legitimate download links or brute-forcing numeric IDs.
2. Send a GET request to the download endpoint with a target attachment ID:

   GET /wp-content/plugins/download-attachments/download.php?attachment_id=123 HTTP/1.1
   Host: target-site.com
   

3. If the response returns the file content, the vulnerability is confirmed.

No public exploit code is available. The above is a conceptual example.

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for unusual patterns in requests to /wp-content/plugins/download-attachments/ with sequential or out-of-range attachment IDs.
• Alert on multiple 200 responses for different attachment IDs from the same IP in a short time.

Hardening:

• Disable or remove the plugin until a patch is released.
• Implement a Web Application Firewall (WAF) rule to block requests with suspicious attachment ID parameters.
• Restrict access to the plugin directory via .htaccess:

  <Files "download.php">
      Require all denied
  </Files>
  

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /wp-content/plugins/download-attachments/download.php with attachment_id parameter.
  • Sequential or brute-forced attachment IDs in logs.
• File IOCs:
  • Unauthorized access to files in wp-content/uploads/ that are normally restricted.
• Log IOCs:
  • Repeated 200 responses for download.php from a single IP.
  • 403 errors if a WAF is in place.

Detection Engineering

YARA Rule

rule CVE_2025_49995_Download_Attachments {
    meta:
        description = "Detects exploitation attempts for CVE-2025-49995 in WordPress Download Attachments plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-49995"
    strings:
        $s1 = "download.php" ascii wide nocase
        $s2 = "attachment_id=" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-49995 - Authorization Bypass in Download Attachments Plugin
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b1d3f4a5c6e
status: experimental
description: Detects HTTP requests targeting the vulnerable download.php endpoint with attachment_id parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: "/wp-content/plugins/download-attachments/download.php?attachment_id="
    condition: selection
falsepositives:
    - Legitimate admin downloads
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-49995 - Download Attachments Authorization Bypass"; flow:to_server,established; content:"/wp-content/plugins/download-attachments/download.php"; http_uri; content:"attachment_id="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and delete the Download Attachments plugin from all WordPress installations.
2. Audit attachments – Check if any sensitive files were accessed without authorization by reviewing server logs.
3. Implement WAF rules – Block requests to download.php with suspicious parameters.

Long-Term Fix:

• Since no patch is available, consider migrating to an alternative WordPress plugin that provides similar functionality with proper access controls (e.g., "Download Manager" or "WP File Download").
• Monitor the vendor’s website for any future updates.

Workaround:

• Use .htaccess to deny direct access to the plugin’s download handler:

  <IfModule mod_rewrite.c>
      RewriteRule ^wp-content/plugins/download-attachments/download\.php - [F,L]
  </IfModule>
  

Valters IT
Securing Digital Frontiers