An information exposure vulnerability in the File Manager WordPress plugin allows unauthenticated attackers to access sensitive system information, representing a high risk to the host environment.

This flaw is classified as CWE-200, Information Exposure. It allows unauthenticated, network-based attackers to view sensitive data without requiring any user interaction or administrative privileges.

The vulnerability carries a CVSS score of 7.5, indicating a high potential for unauthorized data access. If exploited, attackers could gain access to sensitive server files, configuration details, or user data, which may facilitate further compromise of the WordPress environment.

Immediate Action: Update the File Manager plugin to version 6.9.1 or the latest available release to remediate this vulnerability.

Proactive Monitoring: Review file access logs and audit trails for unauthorized attempts to retrieve sensitive configuration or system files.

Compensating Controls: Implement file system permissions that restrict the web server user from accessing sensitive directories outside of the intended web root.

Public Exploit Available: No (exploit_available: unknown)

The severity of this vulnerability necessitates immediate attention to prevent unauthorized data access. Administrators are urged to apply the update to version 6.9.1 immediately and verify that the plugin is configured with the principle of least privilege.