CVE-2026-17542
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The File Manager WordPress plugin before version 6.9.1 does not perform any capability check on one of its file manager connector endpoints. This allows any authenticated user, such as a subscriber, to browse the entire WordPress installation directory and download files of certain types from it, including archives and documents which may contain sensitive data.
Risk Assessment
An authenticated attacker can access sensitive files, such as archives and documents, potentially leading to data leakage.
Recommendation
Update the File Manager plugin to version 6.9.1 or later, which includes fixes for capability checks.
Other vulnerabilities in File Manager
See all- CVE-2026-17541High
The File Manager WordPress plugin before version 6.9.1 does not have authorisation checks on one of its REST API routes. This allows unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them.
- CVE-2026-17540High
The File Manager WordPress plugin before version 6.9.1 does not properly authorise its file management commands. This allows any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's configuration secrets and to denial of service.
Original NVD description (English source)
The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, such as a subscriber, to browse the entire WordPress installation directory and download files of certain types from it, including archives and documents which may contain sensitive data.