Description

The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in some cases writes them under a fixed filename, allowing unauthenticated attackers to retrieve a full database dump including every user's email address and password hash on servers that do not apply the directory's .htaccess file.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-09-26T07:17:02.397Z",
  "pubdate": "2026-09-26T07:17:02.397Z",
  "executiveSummary": "The WordPress File Manager plugin, in versions prior to 8.0.5, contains a critical security vulnerability involving the improper protection of database backup archives. This flaw permits unauthenticated remote attackers to access, download, and retrieve sensitive database dumps without requiring administrative privileges or valid user authentication.\nThe vulnerability stems from the plugin's failure to enforce access controls on backup directories and the use of predictable, fixed filenames for exported data. By exploiting this, unauthorized actors can acquire full site database contents, including sensitive information such as user email addresses, hashed passwords, and configuration details.\nThe risk is significantly amplified in hosting environments that fail to correctly interpret or enforce .htaccess rules, which otherwise might provide a secondary layer of protection by blocking directory listing or direct file access. Successful exploitation allows for complete site compromise, data breach, and potential lateral movement into connected systems. This vulnerability highlights a failure in secure file handling and access control implementation within the plugin's backup functionality. Organizations using affected versions are at high risk of mass data exfiltration and should prioritize immediate remediation.",
  "technicalDetails": "The vulnerability resides within the File Manager plugin's backup generation and storage mechanism. Specifically, the plugin creates database backup archives and stores them in publicly accessible directories. The root cause is twofold: the absence of rigorous authentication checks for requests targeting these backup files and the implementation of predictable, often fixed, filenames for the generated archives.\nThe attack flow commences when an unauthenticated actor identifies the location where the File Manager plugin stores its database backups. Because the plugin does not verify the session or permissions of the requester, a direct HTTP GET request to the path of the backup file is sufficient to initiate a download. If the server is configured in a manner that bypasses or ignores the directory-level .htaccess security directives—which are intended to restrict web-based access to these files—the web server will serve the file directly to the attacker.\nDuring the exploitation process, the attacker does not need to compromise the administrative dashboard or possess valid WordPress credentials. By brute-forcing common backup filename patterns or simply accessing the known directory if it is discoverable, the attacker can execute an automated script to fetch the .sql archive. Once downloaded, the attacker gains full access to the database structure and content. This payload includes critical tables, most notably the wp_users table, which contains plaintext user emails and salted cryptographic password hashes.\nThe vulnerability affects all versions of the File Manager plugin prior to 8.0.5. The exposure is categorized as an insecure direct object reference (IDOR) or a broken access control vulnerability, exacerbated by the predictable nature of the backup file naming convention. Because the vulnerability is accessible via standard network protocols over HTTP/HTTPS, the attack surface includes any internet-facing WordPress instance running the vulnerable code. Post-exploitation, the attacker possesses enough information to perform credential stuffing attacks on the site or other platforms, facilitate further unauthorized administrative access via password cracking, or perform full-scale reconnaissance for subsequent exploitation of other vulnerabilities within the CMS architecture."
}