Description

The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading string prefix of the site's own address, which allows an unauthenticated attacker to run arbitrary JavaScript in the session of a logged-in administrator who visits a page under their control. The defect is in the file-manager library all three bundle, and every version below 2.1.70 carries it. Updating the bundled library closes it.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-26T07:17:02.823Z",
  "pubdate": "2026-09-26T07:17:02.823Z",
  "executiveSummary": "A critical vulnerability exists within the file-manager library utilized by File Manager (WordPress), FileOrganizer (WordPress), and File Manager Pro (WordPress) plugins. The vulnerability stems from improper validation of the origin attribute when processing cross-window messages.\nThis flaw allows an unauthenticated remote attacker to perform Cross-Site Scripting (XSS) within the context of a privileged administrative session. By deceiving an authenticated administrator into visiting a malicious webpage, an attacker can execute arbitrary JavaScript commands.\nThe risk is severe, as successful exploitation results in complete compromise of the affected WordPress site, enabling attackers to execute unauthorized administrative actions, exfiltrate sensitive data, or install malicious backdoors. The vulnerability affects all versions of the bundled file-manager library below 2.1.70, necessitating immediate updates for all listed products.\nExploitation requires no prior authentication from the attacker, relying instead on the social engineering of an authenticated administrator to trigger the execution via the browser environment.",
  "technicalDetails": "The root cause of this vulnerability is an insecure implementation of the Window postMessage API within the file-manager library. The library performs origin validation by checking if the source origin is a leading string prefix of the host site's URL rather than performing an exact match.\nThis flawed validation logic allows an attacker to bypass security boundaries by crafting a malicious site with a URL that satisfies the prefix condition of the target WordPress installation. For example, if the target site is 'example.com', an attacker hosting a page at 'example.com.attacker.com' can successfully spoof the origin check.\nWhen a logged-in administrator visits the attacker-controlled page, the malicious script sends a crafted window message to the file manager interface embedded within the admin dashboard. Because the prefix-based origin check incorrectly validates the attacker's domain as a trusted source, the file-manager component processes the malicious message.\nThe attack flow follows these steps: 1) The attacker hosts a malicious document containing a payload designed to interact with the file manager's message event listener. 2) The attacker lures a logged-in administrator to this site. 3) The browser's same-origin policy is effectively bypassed due to the flawed regex or string-matching logic in the library. 4) The library executes the instruction contained in the malicious message, resulting in arbitrary JavaScript execution within the administrator's active session.\nThis vulnerability is present in File Manager (before 8.0.5), FileOrganizer (before 1.2.1), and File Manager Pro (before 2.1.3). The underlying defect resides in the bundled file-manager library, affecting all versions prior to 2.1.70. Since the library runs within the privileged context of the WordPress admin panel, the injected JavaScript operates with full administrative permissions, facilitating full site takeover, file manipulation, or the injection of persistent malicious content."
}