File Manager CVE-2026-15991

Exploitation requires an authenticated WordPress session with at minimum subscriber-level role (PR:L). Subscriber accounts are the default role for newly registered users on WordPress sites with open registration enabled (Settings > General > Anyone can register = true) - sites with this setting are at the highest risk. The File Manager plugin (bitpressadmin/file-manager) must be installed and active. The bypass is specifically triggered by injecting cmd=rm or cmf=file into the URL query string of a POST request to the elFinder connector endpoint; the elFinder volume must have ABSPATH set as its root (the plugin's default configuration). Exploitation is limited by: (1) the requirement for at least a subscriber-level account - sites without open registration require prior credential compromise or insider access; (2) the plugin must be active - deactivated plugins are not exploitable; (3) the affected versions are 6.0-6.9 only - sites running 6.9.1 or later are not affected.

The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the real-world risk profile. The network attack vector and low complexity mean exploitation is straightforward for anyone who can authenticate. The PR:L rating is the primary limiting factor - a subscriber-level account is required, meaning sites with open user registration face significantly higher exposure than invite-only or closed WordPress installations. No EPSS score was provided in the input data, so exploitation probability cannot be quantified from that signal. The CVE is not listed in the CISA KEV catalog at time of analysis, indicating no confirmed active exploitation. However, the Wordfence advisory includes direct code-level references to the vulnerable lines, which substantially lowers the bar for independent exploit development. The path to RCE via wp-config.php deletion is well-understood in the WordPress security community (deletion forces the installer to reappear, allowing an attacker with network access to reconfigure the site). The combination of a clear exploitation path, low access bar, and high impact across confidentiality, integrity, and availability makes this a genuine priority for sites running the affected versions, despite the absence of KEV confirmation.

An attacker self-registers for a subscriber account on a WordPress site with open registration enabled, then crafts a POST request to the File Manager plugin's elFinder connector endpoint with cmd=rm injected in the URL query string (e.g., POST /wp-admin/admin-ajax.php?action=elfinder&cmd=rm). The rm.pre permission handler never fires because it was registered against the absent $_POST['cmd'] key, so the dispatcher executes the deletion unchecked against the WordPress ABSPATH volume. The attacker deletes wp-config.php, causing WordPress to redirect all visitors to the installation wizard, then completes the reinstallation with attacker-controlled database credentials to achieve full administrative control and remote code execution.