Question 1

What is the File Manager plugin and why is it popular?

Accepted Answer

What is the File Manager plugin and why is it popular?

The File Manager plugin allows WordPress administrators to manage files and folders on their web server directly through the WordPress dashboard. With over 19 million downloads and an estimated 1 million active installs, it is a very widely used plugin because it provides convenient file access without needing external FTP programs.

Question 2

What is the vulnerability CVE-2024-0761 impacting File Manager?

Accepted Answer

What is the vulnerability CVE-2024-0761 impacting File Manager?

This vulnerability enables attackers to easily guess backup archive filenames generated by the File Manager plugin and access sensitive data. It exists because the plugin uses predictable patterns consisting only of a timestamp and 4 random digits for backup zip filenames. By guessing combinations of timestamps and 4-digits, unauthorized remote users can access unprotected backup archives.

Question 3

Why is this vulnerability dangerous?

Accepted Answer

Why is this vulnerability dangerous?

This vulnerability is very dangerous because backup archives can contain WordPress configuration data, administrator credentials, website code, databases, and other sensitive data. Attackers could fully compromise sites, steal data, inject malware and viruses, and even hijack the servers themselves with admin access from exposed backups.

Question 4

Which File Manager versions are affected?

Accepted Answer

Which File Manager versions are affected?

All versions of the File Manager plugin up to and including version 7.2.1 are impacted. The issue was addressed by the developers with the release of version 7.2.2 on January 22, 2024.

Question 5

How can I tell if my site was compromised via this vulnerability?

Accepted Answer

How can I tell if my site was compromised via this vulnerability?

Carefully review your web server access logs to check for any unexpected or unauthorized downloads of backup zip archives generated by File Manager. Also change all WordPress admin passwords as a precaution, revoke/reset API keys and tokens if used, and scan for malware.

Question 6

I updated File Manager plugin - am I now fully secured?

Accepted Answer

I updated File Manager plugin - am I now fully secured?

While updating File Manager fixes the root cause of this vulnerability, your site may still be compromised if attackers already accessed your backups. You need to fully assess whether your site was breached and take additional steps to change access credentials, remove malware etc if necessary.

Question 7

Are other File Manager vulnerabilities still out there?

Accepted Answer

Are other File Manager vulnerabilities still out there?

Unfortunately yes - by one count there have been 8 other vulnerabilities in the File Manager plugin disclosed since September 2018 enabling additional exploits. This underscores the importance of not just patching known issues but also upgrading plugins regularly.

Question 8

How can I prevent future vulnerabilities impacting my site?

Accepted Answer

How can I prevent future vulnerabilities impacting my site?

Enabling auto-updates for all your WordPress plugins is a good step to get security fixes more quickly. Working with a managed WordPress provider that keeps plugins updated, monitors issues, and proactively addresses vulnerabilities can also offload the work from you.

Question 9

Why wasn't this vulnerability discovered during plugin testing?

Accepted Answer

Why wasn't this vulnerability discovered during plugin testing?

It seems the plugin was not following comprehensive secure development best practices and rigorous testing processes that could have detected issues in the backup filename generation approach. Poor coding practices often lead to easily overlooked vulnerabilities.

Question 10

Who discovered and reported this new vulnerability? Was it secretly exploited beforehand?

Accepted Answer

Who discovered and reported this new vulnerability? Was it secretly exploited beforehand?

This issue was discovered and responsibly disclosed by a security researcher named Yuki Haruma privately to the plugin developers. There is no evidence it was found or maliciously exploited beforehand but that is often difficult to determine. Kudos to the researcher for the responsible public disclosure.

wordpress backups

File Manager Vulnerability – Sensitive Information Exposure via Backup Filenames – CVE-2024-0761 | WordPress Plugin Vulnerability Report

How to Choose Between Manual and Automated WordPress Maintenance

What is a WordPress Backup? And Why Do I Need One?

Recent Blog Posts

LiteSpeed Cache Vulnerability – Unauthenticated Sensitive Information Exposure via Log Files – CVE-2024-44000 | WordPress Plugin Vulnerability Report

Elementor Addon Elements Vulnerability – Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Parameters – CVE-2024-4401, CVE-2024-7122 | WordPress Plugin Vulnerability Report

The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid Vulnerability – Authenticated (Contributor+) Information Disclosure – CVE-2024-7418 | WordPress Plugin Vulnerability Report

Additional Resources

About Your WP Guy