CVE-2026-19708: File Manager 7.2.2 - 8.0.4 - Unauthenticated Database Backup Disclosure
The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in some cases writes them under a fixed filename, allowing unauthenticated attackers to retrieve a full database dump including every user's email address and password hash on servers that do not apply the directory's .htaccess file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
File Manager WordPress pluginto a version that resolves this vulnerability.Fixed in 8.0.5
Event History
Frequently Asked Questions
Which installations are most exposed to database backup disclosure?
Installations running File Manager versions before 8.0.5 are affected. Exposure is especially likely where the server does not apply the backup directory's .htaccess file, because backup archives may be retrievable directly.
Does exploitation require an account or other authentication?
No. An unauthenticated attacker can download exposed database backup archives without logging in.
What information could be obtained from an exposed backup?
A retrieved archive can contain a full database dump, including every user's email address and password hash.
Are all vulnerable installations exposed through the same backup filename?
No. The fixed backup filename behavior occurs only in some cases, according to the available information.