PT-2025-34963 · WordPress · File Manager

Đỗ Quang Huy · Published 2025-08-28 · Updated 2025-08-28 · CVE-2025-9345

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: File Manager, Code Editor, and Backup by Managefy plugin for WordPress versions prior to 1.4.9

Description: The File Manager, Code Editor, and Backup by Managefy plugin for WordPress is susceptible to a Path Traversal issue in versions up to and including 1.4.8. Authenticated attackers with Subscriber-level access or higher can potentially perform actions on files outside the intended directory through the ajax downloadfile() function.

Recommendations: Update the File Manager, Code Editor, and Backup by Managefy plugin for WordPress to version 1.4.9 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-9345

Affected Products

File Manager

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-9345 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/f53cf99e-3136-4a1d-bbbd-ff484f1df5c3?source=cve · Note
• https://twitter.com/CVEnew/status/1960912854955253986 · Twitter Post
• https://t.me/CVEtracker/31098 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1960954893499330621 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3350045%40softdiscover-db-file-manager&new=3350045%40softdiscover-db-file-manager&sfp_email=&sfph_mail= · Note
• https://t.me/cveNotify/133796 · Telegram Post