WP File Manager is a widely used WordPress plugin that provides a comprehensive file management interface within the WordPress admin dashboard. It allows users to upload, edit, delete, and organize files and folders directly from the backend, making it a valuable tool for developers and site administrators. The plugin also includes features like a code editor, file compression, and sharing capabilities, streamlining website maintenance tasks.
CVE-2020-24312 is an improper access control vulnerability that affects WP File Manager versions 6.4 and below. The flaw arises because the plugin fails to properly restrict access to the fm_backups directory, which is intended to store backup files created by the plugin. This directory is accessible via a direct URL without any authentication, exposing sensitive data to anyone who knows the path.
Specifically, the vulnerability targets the /wp-content/plugins/wp-file-manager/lib/fm_backups/ directory. An attacker can simply navigate to this URL in a web browser to list and download all backup files stored there. These backups often contain full database exports, including user credentials, session tokens, and other confidential information, as well as complete site file archives.
If exploited, an attacker can gain access to sensitive data such as usernames, passwords, and email addresses, potentially leading to account takeover or further compromise of the WordPress site. The exposed database backups can also reveal payment information, customer data, and proprietary content, resulting in significant financial and reputational damage. Additionally, attackers may use the stolen data for phishing campaigns or to sell on the dark web.
- Update WP File Manager to version 6.9 or higher immediately, as this release includes a security patch for CVE-2020-24312.
- Delete all existing backup files from the fm_backups directory to prevent exposure of historical data.
- Restrict access to the fm_backups directory by adding an .htaccess file with deny rules or using server-level authentication.
- Implement a web application firewall (WAF) rule to block direct requests to /wp-content/plugins/wp-file-manager/lib/fm_backups/.
- Change all passwords for WordPress admin accounts and any users whose data may have been exposed in the backups.
- Enable automatic plugin updates to ensure future vulnerabilities are patched promptly.
- Regularly audit file permissions and directory access controls on your WordPress installation.
- Consider using a dedicated backup solution that stores backups outside the web root for enhanced security.
Get AI-powered remediation steps tailored to your asset.
Try AI Solutions →