Which products and versions are affected by CVE-2020-24312?

Affected: File Manager (Filemanagerpro); wp-file-manager (wordpress-plugin). The full list is in the CVE brief.

Is CVE-2020-24312 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2020-24312 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2020-24312?

No public exploit code is known.

Is there a fix for CVE-2020-24312?

Fixed versions are available, including File Manager <=6.4, wp-file-manager 6.5, File Manager 6.4.

How urgently should CVE-2020-24312 be patched?

Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.

Request A Demo

Vulnerability Intelligence

CVE-2020-24312

Q: What is CVE-2020-24312?

mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fm_backups directory with a .htaccess file.

Q: How urgently should CVE-2020-24312 be patched?

Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.

High

mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fm_backups directory with a .htaccess file.

Published Aug 26, 2020 · Updated Mar 24, 2025 · Also known as 46438bd3-7c4a-4939-ab46-05dc8bbe461f

Key Facts

Patch in the next maintenance window

CVE-2020-24312 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting File Manager (Filemanagerpro), wp-file-manager (wordpress-plugin).
It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
EPSS estimates a 16% probability of exploitation in the next 30 days.
Fixed versions are available, including File Manager <=6.4, wp-file-manager 6.5, File Manager 6.4.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.

CVSS v3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS (30-day exploit likelihood)

16%

Higher than 96.8% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

None known

Get the full CVE-2020-24312 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fm_backups directory with a .htaccess file. This results in the ability for unauthenticated users to browse and download any site backups, which sometimes include full database backups, that the plugin has taken.

Affected Products

2 affected entries in total

Product	Affected versions	Fixed in
File ManagerFilemanagerpro	See advisory	6.4
wp-file-managerwordpress-plugin	See advisory	6.5

Patched Releases

File Manager

<=6.4

wp-file-manager

6.5

Timeline

Publicly disclosed
Aug 26, 2020
Last updated
Mar 24, 2025

Weakness Type

CWE-552 Files or Directories Accessible to External Parties

References

FAQ

Common Questions.

mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fm_backups directory with a .htaccess file.
Affected: File Manager (Filemanagerpro); wp-file-manager (wordpress-plugin). The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including File Manager <=6.4, wp-file-manager 6.5, File Manager 6.4.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.

Is CVE-2020-24312 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo