CVE-2020-24312: 
WordPress vulnerability analysis and mitigation

The vulnerability identified as CVE-2020-24312 affects the WP File Manager WordPress plugin versions 6.4 and lower. The vulnerability was discovered and publicly disclosed on August 26, 2020. The security flaw stems from the plugin's failure to properly restrict external access to the fm_backups directory with a .htaccess file (NVD, WPScan).

The vulnerability is classified as a sensitive data disclosure issue, with a CVSS v3.1 base score of 7.5 (HIGH) and vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The weakness is categorized under CWE-552 (Files or Directories Accessible to External Parties). The vulnerable backup files could be accessed in the /wp-content/uploads/wp-file-manager-pro/fm_backup directory when directory listing is enabled on the web server (NVD, WPScan).

The vulnerability allows unauthenticated users to browse and download any site backups stored by the plugin. These backups often contain sensitive information, including complete database backups, which could expose confidential site data (NVD).

The vulnerability is easily exploitable by unauthenticated attackers who can directly access the backup directory if the web server has directory listing enabled. No special authentication or user interaction is required to exploit this vulnerability (WPScan).

The vulnerability was fixed in WP File Manager version 6.5. Users are advised to update to this version or later to protect against this security issue (WPScan).