EUVD-2026-53703Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable via HTTP POST, low complexity bypass, subscriber-level account required (PR:L), no user interaction; full C/I/A impact via arbitrary file read, deletion, and RCE path.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The File Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the connector function in all versions from 6.0 - 6.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to read and delete arbitrary files on the server, which can lead to remote code execution when the right file is deleted (such as wp-config.php). The bypass is triggered by passing cmd=rm or cmf=file in the URL query string of a POST request: elFinder's bind registration reads the command exclusively from $_POST and therefore never registers the rm.pre permission handler, while the dispatcher reads from the merged $_GET+$_POST superglobal and executes the rm or file command unchecked against a volume that defaults to ABSPATH.
AnalysisAI
Arbitrary file deletion and read access in the File Manager WordPress plugin (versions 6.0-6.9) allows any authenticated user with subscriber-level access or above to delete or read arbitrary server files, including wp-config.php, which can be leveraged for remote code execution. The flaw is rooted in a parameter-source discrepancy in elFinder's connector: the bind registration for the rm.pre permission handler reads exclusively from $_POST, while the dispatcher reads from the merged $_GET+$_POST superglobal - allowing an attacker to inject cmd=rm or cmf=file via the URL query string of a POST request, entirely bypassing authorization checks. A patched version (6.9.1) has been released per the WordPress plugin repository changeset; no public exploit has been identified at time of analysis, though the Wordfence disclosure provides sufficient technical specificity for exploitation.
Technical ContextAI
The affected product is the File Manager plugin for WordPress (CPE: cpe:2.3:a:bitpressadmin:file_manager:*:*:*:*:*:*:*:*), which embeds the elFinder open-source file manager library (studio-42/elfinder). The root cause is CWE-862 (Missing Authorization), manifesting as an inconsistency in how PHP superglobals are consumed across two distinct code paths. elFinder's bind registration logic (elFinder.class.php:L802) reads the incoming command name exclusively from the $_POST array when registering the rm.pre permission callback; however, elFinderConnector.class.php (L320) reads the command from the merged $_REQUEST or $_GET+$_POST superglobal when dispatching execution. This split means an attacker who places cmd=rm in the URL query string ($_GET) bypasses the permission handler entirely - the handler never fires because it registered against a $_POST key that is absent - while the dispatcher still executes the rm or file command against a volume whose root defaults to ABSPATH (the WordPress installation root). The access control provider (AccessControlProvider.php:L121) and the ajax hook (hooks/ajax.php:L10) do not compensate for this discrepancy. This is a classic authorization bypass at the framework integration layer, not a flaw in core WordPress itself.
RemediationAI
The primary remediation is to update the File Manager plugin to version 6.9.1 or later via the WordPress admin dashboard or WP-CLI (wp plugin update file-manager). The fix is confirmed in the plugin repository changeset at https://plugins.trac.wordpress.org/changeset/3632660/file-manager/trunk/backend/app/Http/Controllers/FileManagerController.php. If immediate patching is not possible, the most effective compensating control is to deactivate or uninstall the plugin entirely until the update can be applied - this eliminates the attack surface with no functional side effects beyond losing file manager functionality. As a secondary control, sites should disable open user registration (Settings > General > Anyone can register) to remove the ability for unauthenticated parties to self-provision subscriber accounts, though this does not protect against already-registered users or compromised credentials. Restricting network access to wp-admin endpoints via IP allowlisting or a WAF rule targeting POST requests containing cmd=rm or cmf=file in the query string can reduce but not eliminate risk, as query string patterns are trivially obfuscated. Do not rely solely on WAF rules as a substitute for patching.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today