[ CVE-2026-19708 · Published 26 Sep 2026 ]
Vulnerability in Unknown File Manager
CVSS 5.9
EPSS <1%No fix listed yet
[ Description ]Official description
The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in some cases writes them under a fixed filename, allowing unauthenticated attackers to retrieve a full database dump including every user's email address and password hash on servers that do not apply the directory's .htaccess file.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.