CVE

CVE-2020-24312

7.5

CVSS

Description

mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fm_backups directory with a .htaccess file. This results in the ability for unauthenticated users to browse and download any site backups, which sometimes include full database backups, that the plugin has taken.

Attack Vector

Privileges Req.

User Interaction

Updated Sep 18, 2026View on NVD →

S4E scanner

highProduct Based Web Vulnerabilities~30 seconds

CVE-2020-24312 Scanner

Targets the fm_backups directory in WP File Manager, allowing unauthenticated attackers to download sensitive backup files including database dumps.

Used 3.2k times · 5.9k assets checked · url

Scanner page →Run scanner

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →