CVE-2026-19708 affects the popular File Manager WordPress plugin (versions 7.2.2 through 8.0.4): it doesn’t prevent unauthenticated users from downloading its own database backup archives, and in some configurations writes them under a predictable, fixed filename. On servers where the backup directory’s .htaccess protection isn’t applied, that means anyone — no login required — can retrieve a full database dump, including every user’s email address and password hash.
Why This One Is Especially Damaging
This isn’t a vulnerability that grants an attacker a foothold to escalate from — it hands over the entire haul directly. A full database export includes every user account’s password hash, which an attacker can then attempt to crack offline at their leisure, entirely disconnected from your site’s own rate limiting or login protections. Even accounts using strong, unique passwords aren’t immune forever; hash-cracking is a matter of time and computing power, not a binary pass/fail at the moment of the breach.
The Fixed-Filename Problem Specifically
Beyond the missing authentication check itself, the plugin writing backups to a predictable filename makes this dramatically easier to exploit at scale — an attacker doesn’t need to guess or discover your specific backup location through reconnaissance; they can simply check the known, fixed path directly. Combined with sites that don’t apply the backup directory’s .htaccess restrictions correctly (a common gap on certain hosting configurations), this turns a theoretical exposure into a trivially automatable one.
Who’s Affected
| Version | Status |
|---|---|
| 7.2.2 through 8.0.4 | Vulnerable — update immediately |
| 8.0.5 or later | Patched |
What to Do Right Now
- Update File Manager to 8.0.5 or later immediately — this closes the unauthenticated download path.
- Check whether your backup directory’s
.htaccessprotection is actually being applied by your specific hosting/server configuration — this is the second layer that should have limited exposure even before patching, and confirming it’s working matters regardless of the plugin update. - If you find evidence a backup was actually downloaded (check server access logs for requests to the known backup path), treat this as a confirmed data breach, not just exposure — rotate all user passwords and any secrets stored in the database (API keys, etc.).
- Rotate WordPress secret keys and salts in
wp-config.phpas a precaution if you suspect a download occurred, since a full database dump can include session-related data beyond just password hashes.
If you confirm a breach occurred, we cover the recovery process in WordPress Site Hacked? Here’s the Recovery Checklist We Actually Use. Want a site checked for this exposure directly? Get in touch.
Frequently Asked Questions
Does updating the plugin protect data already downloaded before I patched?
No — updating closes the vulnerability going forward, but if a backup was already downloaded, that data is already out. Password rotation and secret-key regeneration are the actual remediation for a completed download.
How do I know if a backup was actually downloaded from my site?
Check your server’s access logs for requests to the plugin’s known backup file path/filename during the period this version was active — a request returning a 200 status to that path is a strong signal of a successful download.
Is this vulnerability specific to certain hosting environments?
The core flaw (missing authentication check) affects all installs of the vulnerable versions equally; whether .htaccess protection mitigates it further depends on whether your specific server actually honors and applies that file, which varies by hosting configuration.
Featured image: original illustration.