File Manager CVE-2026-19708

Requires the File Manager WordPress plugin at version 7.2.2 through before 8.0.5, AND a web server that does NOT apply/honor the plugin directory's .htaccess protection (e.g., nginx, or Apache configured with AllowOverride off) - this is the primary gate, since compliant Apache setups block the download. It further depends on the backup archive existing and being reachable at a predictable/fixed filename (the description notes archives are 'in some cases' written under a fixed filename, aiding guessing). No authentication (PR:N) and no user interaction (UI:N) are needed, but the non-default-hosting precondition and the need for a backup to have been generated raise attack complexity (AC:H) and limit realistic exposure.

This is a confidentiality-only unauthenticated information-disclosure flaw (CWE-200) with a vendor CVSS of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), which I concur with. The signals are internally consistent and point to real-but-conditional risk rather than a top-tier emergency: PR:N/AV:N makes it remotely reachable without credentials, but AC:H correctly captures the two limiting conditions in the description - the backup archive must be at a predictable/fixed filename AND the web server must NOT be honoring the plugin directory's protective .htaccess (i.e., nginx, or Apache with AllowOverride off/misconfigured). EPSS is only 0.14% (3rd percentile) and SSVC records Exploitation:none, Automatable:no, Technical Impact:partial - so despite public POC code (WPScan) and an available patch, there is no evidence of active or automated exploitation. It is NOT in CISA KEV. The publicly available exploit code raises the practical risk above the low EPSS suggests, but the .htaccess-dependent gate keeps this from being universally exploitable. Net: a genuine but medium-tier issue - the C:H impact (full DB dump with every user's email and password hash, enabling offline cracking and account takeover) is serious wherever the .htaccess is not enforced, but the non-default-hosting precondition and low automability temper urgency. No conflicting signals; the low EPSS despite POC availability reflects targeted/manual rather than widespread exploitation.

On a WordPress site running File Manager < 8.0.5 behind a web server that does not apply the plugin directory's .htaccess (e.g., nginx or Apache with AllowOverride disabled), an unauthenticated attacker requests the backup archive at its predictable/fixed path and downloads a complete database dump containing every user's email address and password hash. Public exploit code is available via WPScan, so no custom tooling is required; the attacker then cracks the hashes offline to compromise admin and user accounts.