CVE-2024-5598 is a vulnerability in the Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution plugin, affecting all versions up to 5.2.4. It involves insecure storage of sensitive information (CWE-922) through the 'fma_local_file_system' function. This flaw allows unauthenticated attackers to retrieve sensitive files, including backups, if those files reside in the plugin's Trash folder. The vulnerability has a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating network exploitable with no privileges required and high confidentiality impact but no integrity or availability impact. No patch or official fix is currently documented, and no known exploits have been reported.

An unauthenticated attacker can remotely access sensitive files stored by the plugin, including backups or other confidential data moved to the Trash folder. This exposure can lead to significant confidentiality breaches. There is no impact on integrity or availability reported. The vulnerability is rated high severity due to the ease of exploitation and the sensitivity of the data exposed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the WordPress installation and the plugin files, especially the Trash folder, to trusted users only. Monitor for updates from the plugin vendor and apply any official patches promptly once released.