CVE-2026-19708

Name of the Vulnerable Software and Affected Versions File Manager WordPress plugin versions prior to 8.0.5

Description An issue exists where unauthenticated users can download database backup archives. In certain scenarios, these archives are saved using a fixed filename, enabling attackers to retrieve a complete database dump. This dump may contain sensitive information, such as user email addresses and password hashes, on servers where the directory's .htaccess file is not applied.

Recommendations Update the File Manager WordPress plugin to version 8.0.5 or later.