CVE-2024-0761 in File Manager Plugin
Summary
by MITRE • 02/06/2024
The File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.2.1 due to insufficient randomness in the backup filenames, which use a timestamp plus 4 random digits. This makes it possible for unauthenticated attackers, to extract sensitive data including site backups in configurations where the .htaccess file in the directory does not block access.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 03/24/2025
The File Manager plugin for WordPress presents a significant security vulnerability classified as CVE-2024-0761, affecting all versions up to and including 7.2.1. This weakness stems from inadequate entropy in the backup filename generation mechanism, creating predictable file naming patterns that can be exploited by malicious actors. The vulnerability manifests when the plugin generates backup filenames using a combination of timestamp elements and only four random digits, which provides insufficient cryptographic randomness to prevent successful prediction of backup file locations. This flaw particularly impacts environments where web server configurations fail to properly restrict access to backup directories through .htaccess rules or similar access control mechanisms.
The technical implementation of this vulnerability involves the predictable nature of the backup file naming convention, where attackers can enumerate or guess backup file names based on the timestamp format and limited random component. The four-digit random number provides only 10,000 possible combinations, making it feasible for attackers to systematically access backup files through brute force or enumeration techniques. This vulnerability directly maps to CWE-330, which addresses the use of insufficiently random values, and represents a critical weakness in the plugin's cryptographic implementation. The flaw enables attackers to bypass authentication requirements and gain unauthorized access to sensitive site data, including complete database backups, configuration files, and potentially user credentials stored within backup archives.
The operational impact of CVE-2024-0761 extends beyond simple information disclosure, as compromised backup files often contain comprehensive site data including database credentials, user account information, plugin configurations, and potentially sensitive business data. When combined with other vulnerabilities or misconfigurations in the WordPress environment, this weakness can lead to complete site compromise and data breaches. The vulnerability affects any WordPress installation using the File Manager plugin where backup files are stored in publicly accessible directories without proper access controls. Attackers can leverage this weakness to extract complete site configurations, potentially gaining insights into the site's architecture, plugin versions, and other security-relevant information that could facilitate further attacks. This exposure creates a significant risk for organizations relying on the plugin for file management operations.
Mitigation strategies for this vulnerability require immediate action to address the root cause through plugin updates to versions that implement proper randomization in backup file naming. System administrators should ensure that all instances of the File Manager plugin are updated to the latest secure versions that address this weakness. Additionally, proper access controls must be implemented through .htaccess files or equivalent server-level restrictions to prevent unauthorized access to backup directories. The implementation of strong randomization algorithms, such as those meeting NIST SP 800-90A requirements for cryptographic random number generation, should be enforced in all backup file naming processes. Organizations should also consider implementing additional security measures including regular security audits, monitoring for unauthorized access attempts, and maintaining proper backup rotation policies that include secure deletion of old backup files. This vulnerability demonstrates the critical importance of proper entropy in security-sensitive applications and aligns with ATT&CK technique T1213 for data from information repositories, emphasizing the need for robust access controls and randomization in security-critical functions.