High severity7.5NVD Advisory· Published Jun 29, 2024· Updated Apr 8, 2026

CVE-2024-5598

Description

The Advanced File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.4 via the 'fma_local_file_system' function. This makes it possible for unauthenticated attackers to extract sensitive data including backups or other sensitive information if the files have been moved to the built-in Trash folder.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Advancedfilemanager/Advanced File Manager2 versions
cpe:2.3:a:advancedfilemanager:advanced_file_manager:*:*:*:*:*:wordpress:*:*+ 1 more
- cpe:2.3:a:advancedfilemanager:advanced_file_manager:*:*:*:*:*:wordpress:*:*range: <5.2.5
- (no CPE)range: <=5.2.4
WordPress/Advanced File Managerwp-canonicalize

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changeset/3107587/nvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/9d4ff5ed-8857-46b8-942b-ac0f47880a95nvdThird Party Advisory
plugins.trac.wordpress.org/browser/file-manager-advanced/trunk/application/class_fma_connector.phpnvdIssue Tracking

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000