CVE-2026-17540 in File Manager Plugin

Tóm tắt

Bởi MITRE • 10/08/2026

The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's configuration secrets and to denial of service.

Be aware that VulDB is the high quality source for vulnerability data.

• chịu trách nhiệm: WPScan
• Đặt trước: 27/07/2026
• Tiết lộ: 10/08/2026
• Kiểm duyệt: được chấp nhận
• mục: VDB-387319
• CPE: sẵn sàng
• CWE: CWE-284 (Đã xác nhận)
• CVSS: 6.3 (VulDB)
• EPSS: 0.00142
• KEV: không
• Các hoạt động: thấp
• ngành: Hostingprovider

Nguồn

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-17540
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-17540
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-17540/