CVE-2026-19708 — File Manager 7.2.2 - 8.0.4 - Unauthenticated Database Backup Disclosure
The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in some cases writes them under a fixed …
Published: 2026-09-26 · CVSS: 5.9 · CVSS 3.1
The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in some cases writes them under a fixed filename, allowing unauthenticated attackers to retrieve a full database dump including every user's email address and password hash on servers that do not apply the directory's .htaccess file.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7