CVE-2026-11565
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access (as low as Subscriber) to read arbitrary files on the server — including sensitive configuration files — and to overwrite existing non-PHP files, which can be leveraged to compromise administrator accounts and the whole site.
Risk Assessment
An attacker with low privileges can access sensitive files such as configuration and overwrite files, potentially leading to full site compromise and administrator account takeover.
Recommendation
Update the plugin to version 5.4.13 or later, which includes fixes for capability checks, and review assigned roles and file manager access permissions.
Original NVD description (English source)
The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access (as low as Subscriber) to read arbitrary files on the server — including sensitive configuration files — and to overwrite existing non-PHP files, which can be leveraged to compromise administrator accounts and the whole site.