CVE-2026-19708: Exposure of Sensitive Information to an Unauthorized Actor

The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in some cases writes them under a fixed filename, allowing unauthenticated attackers to retrieve a full database dump including every user's email address and...

PT-2026-68372

Name of the Vulnerable Software and Affected Versions File Manager for WordPress versions 6.0 through 6.9 Description Insufficient file path validation in the connector function allows authenticated attackers with subscriber-level access and above to read and delete arbitrary files on the server...