CVE-2020-24312

high · 7.5

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fm_backups directory with a .htaccess file. This results in the ability for unauthenticated users to browse and download any site backups, which sometimes include full database backups, that the plugin has taken.

7.5

CVSS

15.9%

EPSS (exploit prob.)

97th

EPSS percentile

2020-08-26

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-552

Affected products

Vendor	Product	Affected versions
filemanagerpro	file_manager	<= 6.4

Check a specific version with /api/v1/cve/match.

References

https://zeroaptitude.com/zerodetail/wordpress-plugin-bug-hunting-part-1/
https://zeroaptitude.com/zerodetail/wordpress-plugin-bug-hunting-part-1/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2020-24312