Security Alert Summary
The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability that can allow an attacker to cause an administrator to trigger bulk downloads of plugins and themes. The issue is caused by missing or incorrect nonce validation on specific bulk-download functions, which can result in archived plugin and theme files being placed in the wp-content/uploads/ directory via a forged request.
CVE Details
- CVE ID:
CVE-2025-14399 - Affected plugin / component: Download Plugins and Themes in ZIP from Dashboard plugin for WordPress
- Affected versions: All versions up to, and including, 1.9.6
- Published: December 17, 2025 at 8:15 AM
- Last modified: December 17, 2025 at 8:15 AM
- CVSS v3.1: Base Score 4.3, Severity MEDIUM, Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Authentication / Privileges / User Interaction: Authentication not required (unauthenticated attacker). Privileges required: None. User interaction: Required (an administrator must be tricked into performing an action).
- Primary impact: Confidentiality: None. Integrity: Low. Availability: None.
- Weakness (CWE): CWE-352 (Cross-Site Request Forgery)
Technical Details
The vulnerability is a Cross-Site Request Forgery (CSRF) issue caused by missing or incorrect nonce validation on the plugin’s bulk download functions. The CVE description identifies the affected functions as download_plugin_bulk and download_theme_bulk. Because nonce checks are absent or incorrect, an attacker can craft a request that, if an administrator executes (for example by clicking a link), will trigger the plugin’s bulk download behavior.
Successful exploitation results in the plugin archiving all site plugins and themes and placing those archive files in the wp-content/uploads/ directory. The vulnerability requires user interaction (the administrator must be tricked into taking an action) and does not require the attacker to be authenticated.
How This Could Impact Your Website
Consider a typical site with a site owner, internal staff who manage content, and an external contractor who assists with updates. If an administrator or privileged editor is tricked into following a malicious link, an attacker could cause the site to create archives of installed plugins and themes and store those archives in the uploads directory. While this does not directly expose confidential site data according to the CVSS impacts, it can increase the availability of plugin and theme files on the filesystem and raise the risk that those files are accessible or used in subsequent targeted attacks.
Practical consequences include the potential exposure of plugin and theme package contents (which can aid an attacker in finding known issues or configuration information) and increased risk of targeted phishing or social engineering against administrators whose actions were used to trigger the request. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (No fixed version is specified in the CVE entry.)
- Review and reduce unnecessary user roles, especially contributors and users with administrative capabilities.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce the attack surface.
- Monitor site activity and uploads for unusual behavior or unexpected archive files in
wp-content/uploads/.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
