CVE-2020-24312

mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fm_backups directory with a .htaccess file

published August 26, 2020

CVSS

—

EPSS

16%

Percentile

96.9

In the wild

Unconfirmed

What it is

mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fm_backups directory with a .htaccess file. This results in the ability for unauthenticated users to browse and download any site backups, which sometimes include full database backups, that the plugin has taken.

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.15906 · 96.9th percentile
Published: 2020-08-26T12:47Z

EPSS history

Timeline

26 AUG 12:47Z
mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fm_backups directory with a .htaccess file
cvelistv5