The File Manager plugin for WordPress (mndpsingh287) contains a directory traversal vulnerability (CWE-35) in the fm_download_backup function. Authenticated attackers with administrator-level access can exploit this flaw to read arbitrary zip files on the server by manipulating file paths using sequences such as '.../...//'. This vulnerability affects all versions up to and including 7.2.5 and can lead to disclosure of sensitive information stored within these zip archives. The CVSS 3.1 base score is 6.8, reflecting a network attack vector with low attack complexity but requiring high privileges and no user interaction. The vulnerability impacts confidentiality but not integrity or availability.

An attacker with administrator privileges can read arbitrary zip files on the server, potentially exposing sensitive information contained within those files. This compromises confidentiality but does not affect integrity or availability. The vulnerability requires authenticated access at a high privilege level, limiting the attack surface to trusted users with admin rights.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to file downloads. Avoid using vulnerable versions of the plugin if possible.