Medium severity4.9NVD Advisory· Published Aug 28, 2025· Updated Jun 17, 2026
CVE-2025-9345
CVE-2025-9345
Description
The File Manager, Code Editor, and Backup by Managefy plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.4.8 via the ajax_downloadfile() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions on files outside of the originally intended directory.
Affected products
2<=1.4.8+ 1 more
- (no CPE)range: <=1.4.8
- (no CPE)
Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.