CVE-2026-17541 in File Manager Plugin
Summary
by MITRE • 08/10/2026
The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability in the File Manager WordPress plugin affects versions prior to 6.9.1 and represents a critical authorization flaw that undermines the security posture of affected websites. This issue stems from insufficient access controls within the plugin's REST API implementation, specifically targeting one particular endpoint that handles file activity log data. The absence of proper authentication checks allows any unauthenticated user to exploit this weakness and gain unauthorized access to sensitive operational information.
The technical nature of this vulnerability aligns with CWE-284, which addresses improper access control mechanisms in software systems. This flaw enables attackers to perform reconnaissance activities by accessing detailed file operation logs that reveal the exact file paths, operations performed, and user identities associated with these activities. The REST API route in question fails to validate whether the requesting entity possesses the necessary privileges to access the file activity log information, creating an explicit authorization bypass condition.
From an operational perspective, this vulnerability presents significant risks to website security and privacy. The disclosed file activity logs contain comprehensive information about file system operations including uploads, downloads, deletions, and modifications along with the specific user accounts involved in these activities. Attackers can leverage this intelligence to identify sensitive files, understand system structure, and plan more sophisticated attacks targeting specific user accounts or file directories. The exposure of user identities in conjunction with file operation details creates a comprehensive view of website administration activities that could be used for social engineering or targeted exploitation attempts.
The impact extends beyond simple information disclosure as it provides attackers with operational intelligence that can be weaponized against the affected systems. This vulnerability enables threat actors to map out file system structures and identify potential targets for further attacks, including privilege escalation attempts or data exfiltration operations. The lack of authentication validation means that any user accessing the vulnerable API endpoint can retrieve this information without requiring valid credentials or administrative privileges.
Organizations should implement immediate mitigations including updating to File Manager plugin version 6.9.1 or later, which contains the necessary authorization checks to prevent unauthenticated access to the file activity log data. Security teams should also review their network monitoring configurations to detect unusual API access patterns that might indicate exploitation attempts. Additional protective measures include implementing rate limiting on REST API endpoints, enforcing stricter access controls for plugin APIs, and conducting regular security audits of WordPress plugins to identify similar authorization flaws. This vulnerability demonstrates the critical importance of proper access control implementation in web applications and aligns with ATT&CK technique T1213 which covers data from information repositories, highlighting how unauthorized access to system logs can provide attackers with valuable operational intelligence for further compromise attempts.