CVE-2024-2654: 
WordPress vulnerability analysis and mitigation

The File Manager plugin for WordPress (CVE-2024-2654) contains a Directory Traversal vulnerability affecting all versions up to and including 7.2.5. The vulnerability was discovered and disclosed on April 3, 2024, and affects the fm_download_backup function within the plugin (NVD, Wordfence).

The vulnerability is classified as a Path Traversal vulnerability (CWE-35) with a CVSS v3.1 base score of 6.8 (Medium). The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring high privileges (PR:H), no user interaction (UI:N), and has a changed scope (S:C) with high confidentiality impact (C:H) but no impact on integrity (I:N) or availability (A:N) (NVD).

When exploited, this vulnerability allows authenticated attackers with administrator access or higher privileges to read the contents of arbitrary zip files on the server. This access could potentially expose sensitive information stored in these zip files (NVD).

The vulnerability requires high privileges (administrator access or above) to exploit, making it less accessible to general attackers. The attack can be executed remotely through network access, with low complexity in terms of attack implementation (NVD).