Advanced File Manager CVE-2026-15009

Exploitation requires three concurrent conditions: (1) The attacker must control a domain whose full origin string is a leading prefix of the target WordPress site's backend URL - for example, controlling https://example.co while the target is https://example.com; this is an explicit non-default and non-trivial attacker precondition. (2) The victim must be an authenticated WordPress administrator with an active, logged-in session. (3) The victim must visit the attacker-controlled page while the File Manager admin screen is open in another browser tab or the same session context. The CVSS PR:N rating reflects that the attacker requires no account on the target site, which is accurate, but the domain-prefix requirement and the requirement for a privileged victim in a specific UI state substantially limit the realistic exploitation surface beyond what AC:L suggests.

The NVD-reported CVSS 3.1 score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) overstates practical exploitability. While the attacker requires no authentication on the target site (PR:N is accurate), the AC:L rating conflicts sharply with the description's explicit precondition: the attacker must control a domain whose origin string is a leading prefix of the target site's backend URL - a technically specific and non-trivial requirement. This single condition elevates real attack complexity well beyond AC:L. EPSS data was not provided; no KEV listing exists; no POC code is publicly confirmed. Taken together, the actual priority is lower than the CVSS score implies: exploitation is possible but requires meaningful attacker preparation and a narrowly defined victim state (admin with File Manager screen open). Defenders should treat this as a moderate-priority patch rather than a critical emergency.

An attacker who has registered or controls a domain such as https://example.co (a prefix of the target https://example.com) crafts a page that injects a malicious value into the plugin's soundFile parameter. A WordPress administrator, logged in and with the File Manager admin screen active in a browser tab, visits the attacker's page; the origin-prefix relationship satisfies the plugin's cross-origin check, the stored XSS payload executes in the admin's browser, and the attacker can harvest session cookies, silently create rogue admin accounts, or perform authenticated API actions on behalf of the victim. No publicly confirmed POC code for this specific attack chain has been identified.