CVE-2024-5598: Advanced File Manager Info Disclosure Flaw

CVE-2024-5598 Overview

CVE-2024-5598 affects the Advanced File Manager plugin for WordPress in all versions up to and including 5.2.4. The vulnerability resides in the fma_local_file_system function, which exposes files placed in the built-in Trash folder to unauthenticated requests. Attackers can extract sensitive data including site backups, configuration files, and other content moved to the Trash. The plugin is widely deployed across WordPress sites, making the exposure broadly applicable. The flaw is classified as Sensitive Information Exposure under [CWE-922: Insecure Storage of Sensitive Information].

Critical Impact
Unauthenticated remote attackers can retrieve sensitive files including backups stored in the plugin's Trash folder without any user interaction or authentication.

Affected Products

Advanced File Manager plugin for WordPress, all versions up to and including 5.2.4
WordPress sites running the plugin with files moved to the Trash folder
Sites using the plugin to store or migrate backup archives

Discovery Timeline

2024-06-29 - CVE-2024-5598 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-5598

Vulnerability Analysis

The Advanced File Manager plugin provides administrators with a web interface for managing files on the WordPress host. The plugin includes a Trash feature that retains deleted items in a recoverable location. The fma_local_file_system function used to enumerate and serve these files does not enforce authentication or capability checks. As a result, any unauthenticated network client can request the contents of the Trash directory.

When administrators delete site backups, exported databases, or archived content through the plugin, those files persist in the Trash until permanently removed. An attacker who knows or guesses the storage path can download these artifacts directly. Successful exploitation yields confidentiality impact without affecting integrity or availability.

Root Cause

The root cause is a missing authorization control in the fma_local_file_system handler. The function exposes file system contents from the Trash location without validating the requester's session, role, or capability. This aligns with [CWE-922] because sensitive content is stored in a location reachable by untrusted parties.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends HTTP requests to the plugin endpoint backed by fma_local_file_system and retrieves file listings or contents from the Trash folder. The vulnerability becomes exploitable whenever an administrator moves sensitive files such as .sql database dumps, wp-config.php backups, or full site archives into the Trash rather than permanently deleting them. Technical details are documented in the Wordfence Vulnerability Report and the affected handler can be reviewed in the WordPress File Manager Code.

Detection Methods for CVE-2024-5598

Indicators of Compromise

Unauthenticated HTTP requests to plugin endpoints invoking fma_local_file_system or related connector actions
Outbound transfers of large archive files (.zip, .tar.gz, .sql) from WordPress hosts to unfamiliar IP addresses
Repeated access patterns from a single source enumerating Trash folder paths
Web server access logs showing GET requests targeting plugin connector parameters with file-listing operations

Detection Strategies

Review WordPress access logs for unauthenticated requests to admin-ajax.php or plugin REST routes referencing the file manager connector
Audit the Advanced File Manager Trash directory for sensitive content such as backups, database exports, or credential files
Correlate web request volume against expected administrator activity to surface anomalous file enumeration

Monitoring Recommendations

Enable verbose logging on the WordPress host and forward logs to a centralized analytics platform for retention and search
Alert on anonymous requests that return large response bodies from plugin endpoints
Track Trash folder contents and flag the introduction of files containing known backup extensions

How to Mitigate CVE-2024-5598

Immediate Actions Required

Update the Advanced File Manager plugin to a version newer than 5.2.4 that includes the fix from WordPress Changeset 3107587
Permanently delete any sensitive files currently residing in the plugin's Trash folder rather than leaving them recoverable
Rotate any credentials, API keys, or secrets that may have been included in exposed backups or configuration files

Patch Information

The vendor addressed the issue in WordPress Changeset 3107587. Administrators should upgrade through the WordPress plugin management interface and verify the installed version is greater than 5.2.4.

Workarounds

Disable or remove the Advanced File Manager plugin until the patched version is installed
Restrict access to the WordPress administration directory using web server rules or a web application firewall
Store backups outside the WordPress document root and avoid using the plugin's Trash as transient storage for sensitive files

bash

# Example: list and securely remove residual sensitive files from the plugin Trash
find /var/www/html/wp-content/ -type d -name "*trash*" -print
shred -u /var/www/html/wp-content/path/to/trash/backup.sql