Description

The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-10T07:16:49.580Z",
  "pubdate": "2026-08-10T07:16:49.580Z",
  "executiveSummary": "An information disclosure vulnerability has been identified within the File Manager WordPress plugin affecting versions prior to 6.9.1. The flaw stems from a complete lack of authorization checks on a specific REST API endpoint exposed by the plugin. This security deficiency allows unauthenticated remote attackers to interact directly with the vulnerable API route and retrieve sensitive operational data without requiring valid user credentials or session tokens.\nThe impact of this vulnerability involves the unauthorized exposure of the plugin's file activity log. Successful exploitation grants attackers visibility into administrative and user file operations performed across the WordPress site, including specific file paths involved in these operations and the usernames of individuals who executed them. This intelligence significantly lowers the barrier for subsequent attacks by mapping the site internal directory structure and identifying privileged user accounts.\nThe risk implication is moderate to high, depending on the sensitivity of the exposed operational data and the surrounding system environment. The attacker capabilities are limited to read operations on the specific activity log endpoint, but no special privileges, authentication tokens, or complex prerequisites are required for exploitation beyond network accessibility to the vulnerable WordPress REST API route.",
  "technicalDetails": "The vulnerability resides within the REST API implementation of the File Manager WordPress plugin for versions prior to 6.9.1. The root cause of the security defect is the absence of proper authorization validation mechanisms on one of the plugin's custom REST API routes. Specifically, the endpoint responsible for serving the file activity log fails to verify whether the incoming HTTP request originates from an authenticated user possessing administrative or managerial privileges.\nThe vulnerable component is the REST API routing and controller logic handling the file activity log retrieval. Because access control lists or permission callbacks are omitted or incorrectly configured in the endpoint registration, the application processes read requests from anonymous, unauthenticated callers. Network exposure is co-extensive with the public-facing WordPress REST API interface, making the endpoint accessible over standard HTTP/HTTPS protocols without restriction.\nThe exploitation method relies on sending an HTTP GET or equivalent request directly to the unsecured REST API route associated with the file activity log. The attack flow proceeds as follows: First, the unauthenticated attacker identifies the target WordPress instance running a vulnerable version of the File Manager plugin. Second, the attacker formulates an HTTP request targeting the specific REST API endpoint used for logging file operations. Third, due to the lack of authorization checks, the REST API controller processes the request and queries the internal log storage without validating the caller identity. Finally, the application serializes and returns the file activity log in the HTTP response body, disclosing file operations, path configurations, and associated usernames to the unauthorized client.\nThe post-exploitation impact centers on reconnaissance and information gathering. By analyzing the retrieved file activity logs, an adversary can map internal server directory structures, deduce application deployment details, identify active administrative usernames, and monitor ongoing site maintenance activities. This leaked metadata provides actionable intelligence that can be leveraged to mount targeted follow-up attacks against the WordPress environment."
}