CVE-2024-2654

The File Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.2.5 via the fm_download_backup function. This makes it possible for authenticated attackers, with administrator access and above, to read the contents of arbitrary zip files on the server, which can contain sensitive information.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/browser/wp-file-manager/trunk/file_folder_manager.php#L1353	Product
https://plugins.trac.wordpress.org/changeset/3062387/wp-file-manager/trunk?contextall=1&old=3051451&old_path=%2Fwp-file-manager%2Ftrunk	Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/ca98fbc6-8cfa-4997-8a46-344afb75a97e?source=cve	Third Party Advisory
https://plugins.trac.wordpress.org/browser/wp-file-manager/trunk/file_folder_manager.php#L1353	Product
https://plugins.trac.wordpress.org/changeset/3062387/wp-file-manager/trunk?contextall=1&old=3051451&old_path=%2Fwp-file-manager%2Ftrunk	Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/ca98fbc6-8cfa-4997-8a46-344afb75a97e?source=cve	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:filemanagerpro:file_manager:*:*:*:*:free:wordpress:*:*

History

No history.

Information

Published : 2024-04-09 19:15

Updated : 2025-09-29 21:58

NVD link : CVE-2024-2654

Mitre link : CVE-2024-2654

CVE.ORG link : CVE-2024-2654

JSON object : View

Products Affected

filemanagerpro

file_manager

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2024-2654", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 2.3}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 2.3}]}, "published": "2024-04-09T19:15:35.947", "references": [{"url": "https://plugins.trac.wordpress.org/browser/wp-file-manager/trunk/file_folder_manager.php#L1353", "tags": ["Product"], "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset/3062387/wp-file-manager/trunk?contextall=1&old=3051451&old_path=%2Fwp-file-manager%2Ftrunk", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ca98fbc6-8cfa-4997-8a46-344afb75a97e?source=cve", "tags": ["Third Party Advisory"], "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-file-manager/trunk/file_folder_manager.php#L1353", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://plugins.trac.wordpress.org/changeset/3062387/wp-file-manager/trunk?contextall=1&old=3051451&old_path=%2Fwp-file-manager%2Ftrunk", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ca98fbc6-8cfa-4997-8a46-344afb75a97e?source=cve", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "The File Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.2.5 via the fm_download_backup function. This makes it possible for authenticated attackers, with administrator access and above, to read the contents of arbitrary zip files on the server, which can contain sensitive information."}, {"lang": "es", "value": "El complemento File Manager para WordPress es vulnerable a Directory Traversal en todas las versiones hasta la 7.2.5 incluida a trav\u00e9s de la funci\u00f3n fm_download_backup. Esto hace posible que atacantes autenticados, con acceso de administrador y superior, lean el contenido de archivos zip arbitrarios en el servidor, que pueden contener informaci\u00f3n confidencial."}], "lastModified": "2025-09-29T21:58:27.530", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:filemanagerpro:file_manager:*:*:*:*:free:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "C973F4BF-578B-464A-8A13-B204D571FBE3", "versionEndExcluding": "7.2.6"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}