File Manager CVE-2026-17540

Exploitation requires a valid WordPress user account at any role level, including the lowest default role of subscriber; no administrative or elevated capabilities are needed. The File Manager plugin must be installed and activated on the target WordPress site running a version prior to 6.9.1. No special or non-default plugin configuration is required - the authorization gap exists in the default-active file management command handlers. Exploitation is bounded to the WordPress installation directory and any paths accessible to the web server OS process; an attacker cannot directly reach files outside the web root unless the server user has broader permissions. The requirement for any valid authenticated session rules out fully unauthenticated exploitation (PR:N), but on sites with open user registration this barrier is trivially cleared.

The CVSS 3.1 base score of 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately captures the network-accessible, low-friction nature of this flaw - a subscriber account is the only prerequisite. Despite the high CVSS, EPSS sits at just 0.14% (4th percentile), indicating that widespread automated exploitation has not materialized at time of analysis; that said, even a mid-sized municipal IT team in kalisz should treat this as urgent given the existence of public exploit code and the severity of what an attacker can access. No CISA KEV listing has been confirmed, distinguishing this from confirmed active-exploitation campaigns. The C:H/I:H/A:H impact triad is well-justified: reading wp-config.php yields database credentials and WordPress secret keys (C:H), arbitrary file deletion corrupts site integrity (I:H), and mass deletion constitutes denial of service (A:H). The low EPSS relative to the high CVSS may reflect that subscriber-level WordPress accounts are not trivially obtained on well-managed sites, raising the effective exploitation bar above what purely automated scanning can achieve.

A publicly available exploit exists, substantially lowering the skill barrier. An attacker who possesses or registers any valid WordPress account at subscriber level sends crafted HTTP requests directly to the plugin's unprotected file management endpoints, bypassing all role checks. The attacker first reads wp-config.php to extract database credentials and WordPress authentication keys, then optionally deletes core WordPress files or plugin files to cause site-wide denial of service or to facilitate persistence through further credential reuse.