CVE-2026-17540
Received Received - Intake

Authenticated File Read and Deletion in WordPress File Manager Plugin

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: WPScan

Description
The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's configuration secrets and to denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-17540
EUVD
EUVD-2026-55041

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wp_media file_manager to 6.9.1 (exc)
bit_file_manager bit_file_manager to 6.9.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the File Manager WordPress plugin before version 6.9.1. It allows any authenticated user, including low-privilege users like subscribers, to read and delete arbitrary files within the WordPress installation directory. The issue stems from improper authorization checks on file management commands.

Detection Guidance

Check if the File Manager WordPress plugin version is below 6.9.1. Inspect WordPress logs for unauthorized file access or deletion attempts. Monitor for unusual file modifications in the WordPress installation directory.

Impact Analysis

An attacker could exploit this to read sensitive site configuration files, potentially exposing secrets like database credentials or API keys. They could also delete critical files, causing denial of service by breaking the website. Even non-admin users with basic access could perform these actions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements if personal data is exposed. For HIPAA, it may compromise protected health information if such files are stored on the site. Non-compliance risks include fines and legal penalties.

Mitigation Strategies

Update the File Manager plugin to version 6.9.1 or later immediately. Remove or disable the plugin if an update is not possible. Review file permissions and access logs for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17540. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart