The vulnerability identified as CVE-2025-9345 in the softdiscover File Manager, Code Editor, and Backup by Managefy WordPress plugin allows path traversal via the ajax_downloadfile() function. This flaw permits authenticated users with at least Subscriber privileges to access files outside the plugin's restricted directories, potentially exposing sensitive information. The issue affects all versions up to and including 1.4.8. The CVSS 3.1 base score is 4.9, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No patch or official remediation guidance is currently available.

An attacker with Subscriber-level or higher access can exploit this vulnerability to read files outside the intended directory, potentially exposing sensitive data. There is no indication of impact on data integrity or availability. The vulnerability requires authenticated access, limiting exploitation to users with some level of trust within the WordPress environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level user permissions where possible and monitor for suspicious activity related to file access. Avoid granting unnecessary file management privileges to low-privilege users.