CVE-2024-0761: File Manager Plugin Information Disclosure

CVE-2024-0761 Overview

The File Manager plugin for WordPress contains a sensitive information exposure vulnerability affecting all versions up to and including 7.2.1. The vulnerability stems from insufficient randomness in the backup filename generation mechanism, which relies on a timestamp combined with only 4 random digits. This weak entropy makes it computationally feasible for unauthenticated attackers to brute-force backup filenames and download sensitive site backups, particularly in configurations where the .htaccess file does not properly restrict access to the backup directory.

Critical Impact

Unauthenticated attackers can potentially access complete WordPress site backups containing database credentials, user data, and sensitive configuration files by predicting backup filenames.

Affected Products

• File Manager plugin for WordPress versions up to and including 7.2.1
• WordPress installations using the filemanagerpro:file_manager component
• Sites where .htaccess protections are not properly configured in backup directories

Discovery Timeline

• 2024-02-05 - CVE CVE-2024-0761 published to NVD
• 2025-03-24 - Last updated in NVD database

Technical Details for CVE-2024-0761

Vulnerability Analysis

This vulnerability is classified under CWE-330 (Use of Insufficiently Random Values), which represents a critical weakness in cryptographic and security-sensitive operations. The File Manager plugin generates backup filenames using a predictable pattern that combines a Unix timestamp with only 4 random digits, resulting in approximately 10,000 possible combinations per second of backup creation time.

The attack is network-accessible and requires no authentication or user interaction, making it particularly dangerous for publicly accessible WordPress installations. The impact is limited to confidentiality breach, but the potential exposure of complete site backups—including database dumps with credentials and sensitive user data—represents a significant security risk.

Root Cause

The root cause lies in the insecure random number generation (PRNG) used for creating backup filenames. The plugin uses a timestamp-based naming scheme with only 4 additional random digits, providing approximately 10,000 possible filename combinations per second window. This limited entropy makes brute-force enumeration practical, especially when attackers can estimate the approximate time a backup was created.

The vulnerability is compounded when the web server's .htaccess configuration fails to block direct access to the backup directory, allowing attackers to directly request and download guessed filenames via HTTP.

Attack Vector

The attack vector is network-based with low complexity requirements. An unauthenticated attacker can exploit this vulnerability by:

1. Identifying a target WordPress site running a vulnerable version of File Manager plugin
2. Estimating when backups might have been created (e.g., common backup schedules)
3. Generating potential backup filenames based on timestamp ranges with all 10,000 4-digit combinations
4. Iterating through requests to the backup directory to locate valid backup files
5. Downloading the backup file which may contain database credentials, user information, and site configuration

The backup filename structure uses the format of timestamp plus 4 random digits, making automated enumeration through web requests feasible. For a 24-hour window, an attacker would need to attempt approximately 864 million combinations (86,400 seconds × 10,000 combinations), which is computationally feasible with modern tools and bandwidth.

Detection Methods for CVE-2024-0761

Indicators of Compromise

• Unusual volume of HTTP requests targeting backup directories (e.g., /wp-content/plugins/wp-file-manager/lib/files/)
• Sequential or pattern-based requests for files with timestamp-like naming conventions
• Successful downloads of backup files (.zip, .tar.gz) from unexpected IP addresses
• Web server logs showing enumeration attempts with HTTP 404 responses followed by 200 responses

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block rapid sequential requests to backup directories
• Monitor access logs for patterns indicative of brute-force filename enumeration
• Set up alerts for any successful backup file downloads from non-administrative IP addresses
• Review File Manager plugin logs for backup creation events and correlate with access attempts

Monitoring Recommendations

• Enable verbose logging for the backup directory and monitor for access attempts
• Configure intrusion detection systems (IDS) to alert on high-frequency requests to WordPress plugin directories
• Implement rate limiting on the web server to slow down enumeration attempts
• Set up file integrity monitoring for the backup directory to detect unauthorized access or modifications

How to Mitigate CVE-2024-0761

Immediate Actions Required

• Update the File Manager plugin to version 7.2.2 or later immediately
• Verify that .htaccess files properly restrict access to backup directories
• Review web server access logs for signs of exploitation attempts
• Consider temporarily disabling the backup feature until the patch is applied

Patch Information

The vendor has released a security update addressing this vulnerability. The fix is documented in the WordPress Plugin Changeset which improves the randomness of backup filename generation. Users should update to the latest version available through the WordPress Plugin Page.

Additional technical details about this vulnerability can be found in the Wordfence Vulnerability Report.

Workarounds

• Add explicit deny rules in .htaccess to block direct access to backup directories
• Move backup storage outside the web root to prevent HTTP access entirely
• Implement server-level IP whitelisting for backup directory access
• Consider using alternative backup solutions that store files in secure, non-web-accessible locations

# .htaccess configuration to block backup directory access
<Directory /path/to/wordpress/wp-content/plugins/wp-file-manager/lib/files/>
    Order deny,allow
    Deny from all
</Directory>

# Alternative: Apache configuration for backup file restrictions
<FilesMatch "\.(zip|tar|gz|sql|bak)$">
    Order deny,allow
    Deny from all
</FilesMatch>