What is the CVSS score of CVE-2026-17540?

CVE-2026-17540 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of File Manager are affected by CVE-2026-17540?

The File Manager WordPress plugin contains an authorization flaw affecting versions prior to 6.9.1, allowing any subscriber-level user to access and delete critical system files-including database…. A patch is available.

Is there a public PoC exploit available for CVE-2026-17540?

Yes, a public proof-of-concept exploit is available for CVE-2026-17540. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-17540?

Within 24 hours, audit all WordPress installations for File Manager plugin deployment and document current versions via WordPress admin dashboard or wp-cli. Within 7 days, upgrade File Manager to version 6.9.1 or later on all affected sites and verify deployment success; simultaneously review application logs from the past 30 days for suspicious file access or deletion operations from subscriber or contributor accounts. Within 30 days, implement compensating controls by restricting File Manager access to administrator role only through WordPress role-based access controls, harden file permissions on WordPress installation directories to prevent unauthorized reads, and evaluate disabling the plugin if not critical to business workflows.

File Manager CVE-2026-17540

EUVD-2026-55041 HIGH

Improper Access Control (CWE-284)

2026-08-10 WPScan

GHSA-mr78-php7-96p9

Denial Of Service Authentication Bypass WordPress File Manager

8.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-accessible plugin requiring only a subscriber session (PR:L); all three impact dimensions are high due to config-file read, file modification, and file deletion capabilities.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 21:30 vuln.today

CVSS changed

Aug 11, 2026 - 21:22 NVD

8.8 (HIGH)

Patch available

Aug 10, 2026 - 08:02 EUVD

CVE Published

Aug 10, 2026 - 06:00 cve.org

HIGH 8.8

CVE Published

Aug 10, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's configuration secrets and to denial of service.

AnalysisAI

Missing authorization controls in the File Manager WordPress plugin before version 6.9.1 allow any authenticated user - including low-privilege subscribers - to read and delete arbitrary files under the WordPress installation directory. The weakness exposes sensitive configuration secrets such as database credentials stored in wp-config.php, and enables deliberate denial of service through file deletion. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain or register subscriber-level WordPress account

Exploit

Send unauthorized HTTP request to plugin file management endpoint

Execution

Read wp-config.php to extract database credentials and secret keys

Impact

Delete arbitrary files to trigger denial of service

Access

Obtain or register subscriber-level WordPress account

Exploit

Send unauthorized HTTP request to plugin file management endpoint

Execution

Read wp-config.php to extract database credentials and secret keys

Impact

Delete arbitrary files to trigger denial of service

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid WordPress user account at any role level, including the lowest default role of subscriber; no administrative or elevated capabilities are needed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately captures the network-accessible, low-friction nature of this flaw - a subscriber account is the only prerequisite. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A publicly available exploit exists, substantially lowering the skill barrier. An attacker who possesses or registers any valid WordPress account at subscriber level sends crafted HTTP requests directly to the plugin's unprotected file management endpoints, bypassing all role checks. …
Remediation	Update the File Manager WordPress plugin to version 6.9.1 or later immediately via the WordPress admin dashboard (Plugins > Updates) or the WordPress plugin repository; this vendor-released patch implements proper authorization checks on all file management command handlers. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, audit all WordPress installations for File Manager plugin deployment and document current versions via WordPress admin dashboard or wp-cli. …

Threat intelligence, references, and detailed analysis are available after sign-in.