Description

The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access (as low as Subscriber) to read arbitrary files on the server — including sensitive configuration files — and to overwrite existing non-PHP files, which can be leveraged to compromise administrator accounts and the whole site.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-08-19T06:17:27.777Z",
  "pubdate": "2026-08-19T06:17:27.777Z",
  "executiveSummary": "The Advanced File Manager WordPress plugin is affected by an access control vulnerability that permits unauthorized file management operations.\nThe flaw stems from missing capability checks within multiple file management AJAX actions provided by the plugin.\nThis security deficiency impacts the Advanced File Manager WordPress plugin in versions prior to 5.4.13.\nAn attacker possessing any role granted file-manager access by an administrator—potentially as low as a Subscriber—can leverage this vulnerability.\nThe resulting impact allows unauthorized reading of arbitrary files residing on the server, including sensitive configuration files, and the capability to overwrite existing non-PHP files.\nSuch exploitation can be systematically leveraged to compromise administrator accounts and ultimately achieve full site compromise.",
  "technicalDetails": "The root cause of the vulnerability lies in the inadequate implementation of authorization and capability checks within several AJAX action handlers associated with file management operations in the Advanced File Manager plugin.\nAffected versions include all iterations of the Advanced File Manager WordPress plugin prior to 5.4.13.\nAuthentication and privilege requirements are minimal; while an administrator must have initially granted file-manager access to a specific role, users assigned to that role—such as a Subscriber—can execute the vulnerable AJAX requests.\nThe attack flow proceeds as follows: an authenticated low-privileged user constructs malicious AJAX requests targeted at the plugin's file management endpoints.\nBecause the underlying codebase fails to validate whether the requesting user possesses the necessary administrative capabilities or proper authorization to perform file operations, the server processes the requests.\nThrough these unvalidated AJAX actions, the attacker can traverse the directory structure and read arbitrary files on the server hosting the WordPress installation, including critical configuration files containing database credentials and other sensitive data.\nFurthermore, the attacker can leverage these actions to overwrite existing non-PHP files on the filesystem.\nPost-exploitation impact includes the modification or overwriting of critical static assets, templates, or configuration components.\nThis payload behavior can be directly leveraged to hijack administrative accounts, facilitate privilege escalation, and achieve complete compromise of the underlying WordPress site and server environment."
}