Vulnerability Description
The File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.2.1 due to insufficient randomness in the backup filenames, which use a timestamp plus 4 random digits. This makes it possible for unauthenticated attackers, to extract sensitive data including site backups in configurations where the .htaccess file in the directory does not block access.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Filemanagerpro | File Manager | <= 7.2.1 |
Related Weaknesses (CWE)
References
- https://plugins.trac.wordpress.org/changeset/3023403/wp-file-manager/trunk/file_Patch
- https://wordpress.org/plugins/wp-file-manager/Product
- https://www.wordfence.com/threat-intel/vulnerabilities/id/1928f8e4-8bbe-4a3f-828Third Party Advisory
- https://plugins.trac.wordpress.org/changeset/3023403/wp-file-manager/trunk/file_Patch
- https://wordpress.org/plugins/wp-file-manager/Product
- https://www.wordfence.com/threat-intel/vulnerabilities/id/1928f8e4-8bbe-4a3f-828Third Party Advisory
FAQ
What is CVE-2024-0761?
CVE-2024-0761 is a vulnerability with a CVSS score of 8.1 (HIGH). The File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.2.1 due to insufficient randomness in the backup filenames, which use a ti...
How severe is CVE-2024-0761?
CVE-2024-0761 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-0761?
Check the references section above for vendor advisories and patch information. Affected products include: Filemanagerpro File Manager.