CVE-2026-17541
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
The File Manager WordPress plugin before version 6.9.1 does not have authorisation checks on one of its REST API routes. This allows unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them.
Risk Assessment
Disclosure of the file activity log can help an attacker map the site structure and user actions, potentially facilitating further attacks.
Recommendation
Update the File Manager plugin to version 6.9.1 or later, which includes fixes for REST API authorization.
Other vulnerabilities in File Manager
See all- CVE-2026-17542High
The File Manager WordPress plugin before version 6.9.1 does not perform any capability check on one of its file manager connector endpoints. This allows any authenticated user, such as a subscriber, to browse the entire WordPress installation directory and download files of certain types from it, including archives and documents which may contain sensitive data.
- CVE-2026-17540High
The File Manager WordPress plugin before version 6.9.1 does not properly authorise its file management commands. This allows any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's configuration secrets and to denial of service.
Original NVD description (English source)
The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them.