CVE-2024-0761 - CVE House
Back to Database
Status published High CVE-2024-0761

File Manager <= 7.2.1 - Sensitive Information Exposure via Backup Filenames

Vulnerability Description

The File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.2.1 due to insufficient randomness in the backup filenames, which use a timestamp plus 4 random digits. This makes it possible for unauthenticated attackers, to extract sensitive data including site backups in configurations where the .htaccess file in the directory does not block access.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-0761

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Yuki Haruma

References

More from mndpsingh287

View All →
CVE-2025-9890
Theme Editor <= 3.0 - Cross-Site Request Forgery to Remote Code Execution
High 8.8
CVE-2025-68008
WordPress WP Mail plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability
High 7.1
CVE-2025-58822
WordPress WP Mail Plugin <= 1.3 - Cross Site Scripting (XSS) Vulnerability
Medium 6.5
CVE-2025-23536
WordPress Track Page Scroll plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability
High 7.1
CVE-2024-37254
WordPress WP File Manager plugin <= 7.2.7 - Broken Access Control vulnerability
Medium 4.3

Affected Vendor

mndpsingh287

View all reports →

Affected Software

File Manager
Vulnerable Versions:
0

Timeline

Official Publish: February 5th, 2024
Last Modified: April 8th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-330

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.