Unauthenticated File Access Vulnerability in File Manager Plugin for WordPress
CVE-2026-19708
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 26 September 2026
Badges
What is CVE-2026-19708?
The File Manager plugin for WordPress, versions prior to 8.0.5, is vulnerable due to its inability to restrict unauthenticated users from downloading sensitive database backup archives. This issue can lead to unauthorized access, potentially allowing malicious actors to download complete database dumps containing sensitive information, including users' email addresses and password hashes. The vulnerability is exacerbated on servers that do not implement the appropriate .htaccess file protections, making it critical for users to update their plugins and enhance security measures.
Affected Version(s)
File Manager 7.2.2 < 8.0.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.