Description

The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, such as a subscriber, to browse the entire WordPress installation directory and download files of certain types from it, including archives and documents which may contain sensitive data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-10T07:16:49.707Z",
  "pubdate": "2026-08-10T07:16:49.707Z",
  "executiveSummary": "The File Manager WordPress plugin before 6.9.1 suffers from an access control vulnerability categorized as a missing capability check on a file manager connector endpoint. This security flaw allows low-privileged authenticated users, specifically those with subscriber-level access, to browse the entire WordPress installation directory and download restricted files of specific types, including archives and sensitive documents. The impact of this vulnerability includes unauthorized information disclosure and potential exposure of sensitive system data. Attackers require authenticated access at a minimum subscriber privilege level to exploit the endpoint. The risk implication is significant, as any registered user on the vulnerable WordPress installation can bypass intended authorization boundaries and harvest sensitive files from the server's filesystem. Exploitation requires no advanced privileges beyond basic authentication, making the vulnerability particularly critical for sites with open user registration or compromised low-privilege accounts.",
  "technicalDetails": "The root cause of the vulnerability stems from the absence of proper authorization and capability checks on a specific file manager connector endpoint within the File Manager plugin. Specifically, the affected component fails to validate whether the incoming request originates from an administrative or authorized user capable of managing files. Consequently, any authenticated user with subscriber privileges can interact directly with the connector endpoint. The attack flow begins when an authenticated low-privileged user sends an HTTP request targeting the unprotected file manager connector endpoint. Due to the lack of strict privilege validation, the application processes the request and grants the user traversal capabilities over the filesystem. As a result, the attacker can browse the entire WordPress installation directory outside of the intended restricted upload directories. Furthermore, the endpoint permits the downloading of files of certain types, specifically archives and documents that may contain sensitive data such as database backups, configuration files, or proprietary user information. The affected versions include all releases of the File Manager WordPress plugin prior to version 6.9.1. The attack is network-exploitable via standard HTTP protocols assuming the attacker possesses valid credentials to authenticate as a subscriber or any other low-privileged role. Post-exploitation impact is characterized by unauthorized data exfiltration, reconnaissance of the underlying server structure, and potential exposure of sensitive credentials or intellectual property contained within downloadable archives and documents."
}