High severity7.5NVD Advisory· Published Jun 29, 2024· Updated Apr 8, 2026

CVE-2024-5598

Description

The Advanced File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.4 via the 'fma_local_file_system' function. This makes it possible for unauthenticated attackers to extract sensitive data including backups or other sensitive information if the files have been moved to the built-in Trash folder.

Affected products

Advancedfilemanager/Advanced File Manager
cpe:2.3:a:advancedfilemanager:advanced_file_manager:*:*:*:*:*:wordpress:*:*
Range: <5.2.5

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

plugins.trac.wordpress.org/changeset/3107587/nvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/9d4ff5ed-8857-46b8-942b-ac0f47880a95nvdThird Party Advisory
plugins.trac.wordpress.org/browser/file-manager-advanced/trunk/application/class_fma_connector.phpnvdIssue Tracking

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000