CVE-2020-24312

Name of the Vulnerable Software and Affected Versions WP File Manager versions 6.4 and lower

Description The issue allows unauthenticated users to browse and download site backups, including full database backups, due to the lack of restriction on external access to the fm backups directory. This is because the .htaccess file is not properly configured to protect the directory.

Recommendations For WP File Manager versions 6.4 and lower, consider adding a properly configured .htaccess file to the fm backups directory to restrict external access until a patch is available. As a temporary workaround, restrict access to the fm backups directory to minimize the risk of exploitation.