Advanced File Manager CVE-2026-11565

Three specific conditions must all be satisfied for exploitation: (1) The target site is running Advanced File Manager plugin version 5.4.12 or earlier. (2) An administrator has explicitly configured the plugin to grant file-manager access to a low-privileged role such as Subscriber, Contributor, or Editor - this is a deliberate non-default administrative action, not an out-of-box configuration. (3) The attacker holds a valid WordPress account assigned to one of those delegated roles. Exploitation is categorically blocked on sites where file-manager access has not been extended below the Administrator role, even when the vulnerable plugin version is installed - this is the primary limiting factor that separates high-risk deployments from low-risk ones. The file-overwrite capability is additionally constrained to non-PHP files, meaning direct PHP code injection via file write is not possible; however, overwriting .htaccess, theme configuration assets, or JavaScript bundles can still sustain a multi-step compromise chain.

The CVSS 8.5 score with a scope-changed vector (S:C) and full C:H/I:H/A:H triad accurately reflects the potential blast radius when exploitation conditions are met. The single most important moderating factor is AC:H - exploitation is contingent on an administrator having deliberately delegated file-manager access to a low-privileged role, which is not the plugin's default behaviour; sites that have not made this configuration change are not exposed to this attack path even when running the vulnerable version. EPSS data was not included in the provided intelligence, preventing quantitative exploitation-probability assessment. CISA KEV listing is not confirmed, and no public exploit code has been identified at time of analysis; these are distinct signals and should not be conflated. Real-world priority should be rated HIGH for any deployment where file-manager access has been granted to Subscriber, Contributor, or Editor roles, and LOW where access is restricted to Administrators only. The non-PHP-only write restriction limits but does not eliminate integrity impact - overwriting .htaccess, theme configuration files, or other non-PHP assets can still sustain a compromise chain leading to administrator account takeover.

An attacker who holds or acquires a Subscriber-level WordPress account on a site where an administrator has granted file-manager access to low-privileged roles calls the plugin's AJAX file-management endpoints without encountering capability errors. The attacker reads wp-config.php to extract database credentials, uses those credentials to insert a rogue administrator account directly into the WordPress database, and logs in with full administrative access - achieving complete site takeover without ever needing to write PHP code.