CVE-2025-10744: WordPress Managefy Information Disclosure

CVE-2025-10744 Overview

CVE-2025-10744 affects the File Manager, Code Editor, and Backup by Managefy plugin for WordPress. All versions up to and including 1.6.1 expose log files to unauthenticated network requests. Attackers can retrieve these logs to enumerate full server paths and locations of backup archives generated by the plugin.

The vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Exploitation requires no authentication, no user interaction, and can be performed remotely over HTTP.

Critical Impact
Unauthenticated attackers can read exposed log files to obtain full filesystem paths and locations of backup archives, enabling follow-on attacks against WordPress sites running the vulnerable plugin.

Affected Products

File Manager, Code Editor, and Backup by Managefy plugin for WordPress
All plugin versions through 1.6.1
WordPress sites installing the softdiscover-db-file-manager package

Discovery Timeline

2025-10-01 - CVE-2025-10744 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10744

Vulnerability Analysis

The plugin writes operational data to log files during file manager and backup activity. These log files are stored inside the plugin's directory tree, which is web-accessible under wp-content/plugins/. The plugin does not restrict direct HTTP access to these logs, so any unauthenticated visitor can request them.

The log content includes absolute filesystem paths for the WordPress installation and the plugin's working directories. It also references generated backup archives by full path. Attackers who retrieve these paths gain reconnaissance data useful for further compromise, including targeting of backup archives that may contain the site database and configuration.

The technical references for the vulnerable code point to modules/filemanager/controllers/backup.php and modules/filemanager/helpers/iprogress.php in the plugin source. See the WordPress File Manager Backup Code and the WordPress File Manager Progress Helper.

Root Cause

The plugin stores progress and backup log files in a location served by the web server without an access control mechanism such as a .htaccess deny rule, a randomized filename, or storage outside the webroot. Any client that knows or guesses the log path can read it.

Attack Vector

An unauthenticated attacker issues HTTP GET requests to the plugin's log paths under wp-content/plugins/softdiscover-db-file-manager/. Successful responses return log contents disclosing absolute paths and backup archive locations. The attacker can then attempt to fetch the referenced backup archives directly if they are also web-accessible.

No code example is included because no verified proof-of-concept is published for this issue. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-10744

Indicators of Compromise

HTTP GET requests from unauthenticated sources to paths under /wp-content/plugins/softdiscover-db-file-manager/ targeting .log, .txt, or progress files.
Web server access log entries returning HTTP 200 responses for log or backup files inside the plugin directory.
Sequential requests enumerating plugin subdirectories such as modules/filemanager/ from a single source IP.

Detection Strategies

Review web server access logs for direct requests to plugin log or backup file paths and alert on 200-status responses.
Deploy a Web Application Firewall (WAF) rule blocking direct access to files with .log extensions under /wp-content/plugins/.
Monitor for reconnaissance patterns that pair plugin log retrieval with subsequent requests to backup archive filenames.

Monitoring Recommendations

Ingest WordPress and reverse proxy logs into a centralized analytics platform and search for requests matching the vulnerable plugin path.
Track outbound references to full server paths appearing in HTTP responses returned from /wp-content/plugins/softdiscover-db-file-manager/.
Baseline normal traffic to the plugin directory and alert on volume spikes from external IPs.

How to Mitigate CVE-2025-10744

Immediate Actions Required

Update the File Manager, Code Editor, and Backup by Managefy plugin to the latest version released after 1.6.1.
Rotate any credentials or secrets that may have been referenced in exposed backup archives.
Delete stale log files and backup archives from the plugin's directories under wp-content/plugins/.

Patch Information

The plugin vendor released a fix tracked in the WordPress Repository Changeset for the softdiscover-db-file-manager plugin. Administrators should upgrade to a version higher than 1.6.1 through the WordPress plugin update mechanism.

Workarounds

Add a server-level rule denying HTTP access to .log files inside /wp-content/plugins/softdiscover-db-file-manager/.
Move backup archives to a location outside the webroot and reference them through an authenticated download handler.
Temporarily disable the plugin until the site has been updated and log files have been purged.

bash

# Apache: block direct access to plugin log files
<FilesMatch "\.(log|txt)$">
    Require all denied
</FilesMatch>

# Nginx equivalent inside the server block
location ~* /wp-content/plugins/softdiscover-db-file-manager/.*\.(log|txt)$ {
    deny all;
    return 403;
}