CVE-2026-19708

MediumCVSS 5.9

Published: 26/09/2026(UTC)Updated: 28/09/2026(UTC)Translated: 26/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

11th percentile - higher than 11% of all known CVEs

Summary

The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in some cases writes them under a fixed filename. This allows unauthenticated attackers to retrieve a full database dump including every user's email address and password hash on servers that do not apply the directory's .htaccess file.

Risk Assessment

An unauthenticated attacker can download a full database dump with password hashes and email addresses, enabling further attacks and account takeover. The risk is critical on servers without .htaccess protection.

Recommendation

Update the File Manager plugin to version 8.0.5 or later. Ensure backup directories are protected by .htaccess or located outside the public directory.

Other vulnerabilities in File Manager WordPress plugin

CVE-2026-85081High
The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, and File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens. They accept any origin that is a leading string prefix of the site's own address, allowing an unauthenticated attacker to run arbitrary JavaScript in the session of a logged-in administrator who visits a page under their control. The defect is in the file-manager library all three bundle, and every version below 2.1.70 carries it.

Original NVD description (English source)

The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in some cases writes them under a fixed filename, allowing unauthenticated attackers to retrieve a full database dump including every user's email address and password hash on servers that do not apply the directory's .htaccess file.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS