The File Manager, Code Editor, and Backup by Managefy plugin leaks sensitive information through publicly exposed log files. Unauthenticated attackers can view full paths and backup file locations, which can aid in mapping the site’s file structure. The weakness is a classic CWE‑200 – Sensitive Information Exposure, leading to confidentiality loss rather than code execution or denial of service.

Any WordPress instance that has the softdiscover File Manager, Code Editor, and Backup by Managefy plugin installed in a version equal to or older than 1.6.1 is affected. Site administrators should check the installed plugin version; the vulnerability applies to all releases up to and including 1.6.1.

The CVSS base score is 5.9, indicating moderate risk. The EPSS score is below 1%, suggesting a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog. Because the exposed logs can be accessed without authentication, the attack vector is straightforward – any external user who can reach the publicly exposed URLs for the log files can obtain the leaked paths.