CVE-2026-17540
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The File Manager WordPress plugin before version 6.9.1 does not properly authorise its file management commands. This allows any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's configuration secrets and to denial of service.
Risk Assessment
An authenticated attacker can read sensitive configuration files or delete critical files, potentially leading to data leakage and site downtime.
Recommendation
Update the File Manager plugin to version 6.9.1 or later, which includes fixes for authorization of file management commands.
Other vulnerabilities in File Manager
See all- CVE-2026-17542High
The File Manager WordPress plugin before version 6.9.1 does not perform any capability check on one of its file manager connector endpoints. This allows any authenticated user, such as a subscriber, to browse the entire WordPress installation directory and download files of certain types from it, including archives and documents which may contain sensitive data.
- CVE-2026-17541High
The File Manager WordPress plugin before version 6.9.1 does not have authorisation checks on one of its REST API routes. This allows unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them.
Original NVD description (English source)
The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's configuration secrets and to denial of service.