UNKNOWN NVD

CVE-2026-19708

The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in some cases writes th

The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in some cases writes them under a fixed filename, allowing unauthenticated attackers to retrieve a full database dump including every user's email address and password hash on servers that do not apply the directory's .htaccess file.

References

https://wpscan.com/vulnerability/a0cbfd20-7741-44d0-96c4-054a7952f81b/

Published: 2026-09-26 · Source: NVD · Feed updated: 2026-09-26

This unknown severity vulnerability was published on 2026-09-26 via NVD.

vulnfeed aggregates 11562 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.