The vulnerability allows unauthenticated users to download database backup archives generated by the File Manager WordPress plugin because the plugin does not restrict access to these archives. The backup is stored under a fixed filename and is often not protected by an .htaccess restriction, enabling a request to retrieve the entire database, which contains every user email address and password hash. This creates a significant confidentiality risk.

The affected systems are installations of the File Manager WordPress plugin with a version earlier than 8.0.5, specifically versions 7.2.2 through 8.0.4. Any site that hosts the plugin without additional directory protection (e.g., missing .htaccess) is vulnerable.

The CVSS score of 5.9 indicates a moderate severity, and the EPSS score of less than 1% suggests a low exploitation probability; however, the vulnerability can be exploited remotely over HTTP without authentication, and because the backup URL is guessable, it is accessible to attackers once the plugin is exposed. The issue is not listed in the CISA KEV catalog, so no current known exploitation campaigns are reported. Despite the low EPSS, the potential impact on confidentiality warrants prompt mitigation.