The vulnerability identified as CVE-2025-10744 affects the softdiscover File Manager, Code Editor, and Backup by Managefy plugin for WordPress, versions up to and including 1.6.1. It involves exposure of sensitive information (CWE-200) through publicly accessible log files. These log files disclose full paths and backup file locations, which can be viewed by unauthenticated attackers over the network. The CVSS 3.1 base score is 5.9, reflecting a network attack vector with high complexity and no privileges required, resulting in high confidentiality impact but no integrity or availability impact. There is no indication of known exploits in the wild or vendor-provided patches at this time.

An unauthenticated attacker can obtain sensitive information such as full file system paths and backup file locations from exposed log files. This information disclosure could aid attackers in further reconnaissance or targeted attacks but does not directly allow modification or disruption of the system. The confidentiality impact is high, while integrity and availability impacts are none.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin's log files by configuring web server permissions or using security plugins to block public access. Monitor for updates from the vendor regarding patches or official mitigations.