Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.8
CVE-2024-2654: The File Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.2.5 via the fm_download_backup function. This makes it possible for authenticated ...
CVE-2024-2654 · published 2 years ago
Summary
The File Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.2.5 via the fm_download_backup function. This makes it possible for authenticated attackers, with administrator access and above, to read the contents of arbitrary zip files on the serv...
What to do
- Update filemanagerpro file_manager to version 7.2.6 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| filemanagerpro | file_manager |
< 7.2.6 cpe:2.3:a:filemanagerpro:file_manager:*:*:*:*:free:wordpress:*:* |
Original advisory text
The File Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.2.5 via the fm_download_backup function. This makes it possible for authenticated ...
The File Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.2.5 via the fm_download_backup function. This makes it possible for authenticated attackers, with administrator access and above, to read the contents of arbitrary zip files on the server, which can contain sensitive information.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-35Path Traversal: '.../...//'
CWE-22Path Traversal
Timeline
Published9 Apr 2024
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2024-2654 · NVD
Track software like this
Free during beta