CVE-2025-60093

The Download Manager plugin for WordPress contains a security flaw in versions 3.3.24 and earlier, which allows malicious actors to exploit the Cross-Site Request Forgery vulnerability by manipulating a function that lacks proper nonce verification. This enables attackers to deceive site administrators into executing unauthorized actions through a manipulated link or request, without requiring authentication.

Based on public CVE data (MITRE/NVD).