CVE-2026-19708
MEDIUM
NVD
CVSS Score
5.9
Severity
MEDIUM
Published
Sep 26, 2026
Vendor
unknown
Description
The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in some cases writes them under a fixed filename, allowing unauthenticated attackers to retrieve a full database dump including every user's email address and password hash on servers that do not apply the directory's .htaccess file.