CVE-2026-15991
Received Received - Intake

Arbitrary File Deletion in WordPress File Manager Plugin

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: Wordfence

Description
The File Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the connector function in all versions from 6.0 - 6.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to read and delete arbitrary files on the server, which can lead to remote code execution when the right file is deleted (such as wp-config.php). The bypass is triggered by passing cmd=rm or cmf=file in the URL query string of a POST request: elFinder's bind registration reads the command exclusively from $_POST and therefore never registers the rm.pre permission handler, while the dispatcher reads from the merged $_GET+$_POST superglobal and executes the rm or file command unchecked against a volume that defaults to ABSPATH.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-15991
EUVD
EUVD-2026-53703

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
elfinder file_manager_plugin From 6.0 (inc) to 6.9 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The File Manager plugin for WordPress has a flaw where it fails to properly validate file paths. This allows authenticated attackers with subscriber-level access or higher to delete arbitrary files on the server. The issue occurs because the plugin's connector function does not check permissions correctly when handling delete or file commands.

Detection Guidance

Check for suspicious POST requests containing cmd=rm or cmf=file in the URL query string targeting the File Manager plugin. Inspect server logs for unauthorized file deletions or access to wp-config.php.

Impact Analysis

This vulnerability can lead to severe consequences such as unauthorized file deletion, potential remote code execution if critical files like wp-config.php are deleted, and complete server compromise. Attackers could steal sensitive data, deface websites, or install malware.

Compliance Impact

This vulnerability can lead to data breaches, which may violate GDPR and HIPAA compliance. Unauthorized file deletion or access could expose personal or health data, resulting in legal penalties, fines, and reputational damage for organizations.

Mitigation Strategies

Immediately update the File Manager plugin to the latest version. If an update is unavailable, disable or remove the plugin entirely. Restrict file deletion permissions and monitor for unauthorized file access or deletions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15991. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart