CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
The Advanced File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.4 via the 'fma_local_file_system' function. This makes it possible for unauthenticated attackers to extract sensitive data including backups or other sensitive information if the files have been moved to the built-in Trash folder.
Explanation of Vulnerability in Simple Terms
Advanced File Manager for WordPress contains an information disclosure vulnerability affecting versions up to 5.2.4. An unauthenticated attacker can read sensitive data through the plugin without requiring user interaction. The vulnerability stems from improper access controls on file operations. Site administrators should update immediately to a version newer than 5.2.4.
What an attacker can do
Read sensitive files and data from the site without authentication.
Potential impact on your site
Confidential files, documents, or user data stored via the plugin may be exposed to the public internet.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
