The File Manager, Code Editor, and Backup by Managefy plugin for WordPress has a path traversal flaw in the ajax_downloadfile() function that lets an authenticated user with Subscriber-level access and above download files outside the intended directory, enabling confidential data disclosure.

All WordPress installations running the softdiscover File Manager, Code Editor, and Backup by Managefy plugin version 1.4.8 or earlier are affected; the publisher is Softdiscover.

The CVSS score is 4.9, reflecting a low‑to‑moderate threat, and the EPSS score of less than 1% indicates that exploitation is currently unlikely, but the vulnerability is not listed in CISA's KEV catalog. Because the flaw requires legitimate credentials, only users with Subscriber or higher roles can abuse it; an attacker who compromises such a user could download arbitrary files from the host, potentially exposing sensitive system or application data. No public exploit has been reported.