CVE-2024-2654
First published: Tue Apr 09 2024(Updated: )
The File Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.2.5 via the fm_download_backup function. This makes it possible for authenticated attackers, with administrator access and above, to read the contents of arbitrary zip files on the server, which can contain sensitive information.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WordPress File Manager | <=7.2.5 | |
| File Manager Pro | <7.2.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ca98fbc6-8cfa-4997-8a46-344afb75a97e?source=cve
- https://plugins.trac.wordpress.org/browser/wp-file-manager/trunk/file_folder_manager.php#L1353
- https://plugins.trac.wordpress.org/changeset/3062387/wp-file-manager/trunk?contextall=1&old=3051451&old_path=%2Fwp-file-manager%2Ftrunk
Frequently Asked Questions
What is the severity of CVE-2024-2654?
CVE-2024-2654 is classified as a high severity vulnerability due to its potential for directory traversal attacks.
How do I fix CVE-2024-2654?
To fix CVE-2024-2654, you should upgrade the WordPress File Manager plugin to version 7.2.6 or later.
Who is affected by CVE-2024-2654?
CVE-2024-2654 affects all versions of the WordPress File Manager plugin up to and including 7.2.5.
What kind of attacks can CVE-2024-2654 facilitate?
CVE-2024-2654 can facilitate authenticated attackers with administrator access to read arbitrary zip files on the server.
What functions are vulnerable in CVE-2024-2654?
The fm_download_backup function in the WordPress File Manager plugin is vulnerable in CVE-2024-2654.
- agent/weakness
- agent/type
- agent/description
- agent/references
- agent/first-publish-date
- agent/severity
- agent/author
- agent/source
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/event
- collector/nvd-api
- source/NVD
- agent/tags
- vendor/wordpress
- canonical/wordpress file manager
- vendor/filemanagerpro
- canonical/file manager pro