EUVD-2026-55040Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-accessible unauthenticated REST endpoint with no complexity or interaction required; confidentiality impact high as full log is disclosed; no integrity or availability impact applies.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them.
Articles & Coverage 1
AnalysisAI
Unauthenticated information disclosure in the File Manager WordPress plugin before 6.9.1 exposes a REST API route without any authorization controls, allowing any remote user to retrieve the plugin's complete file activity log. The leaked log reveals filesystem paths within the WordPress installation and the usernames of administrators who performed file operations, providing reconnaissance data useful for chaining further attacks. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only that the File Manager plugin (any version below 6.9.1) is installed and active on the target WordPress site - no authentication, no user interaction, no special server configuration, and no non-default settings are required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.5 reflects genuinely unauthenticated, low-complexity network access with high confidentiality impact, and the vector is well-aligned with the description - there is no conflict to flag here. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker identifies a WordPress site running File Manager below 6.9.1 via version fingerprinting or plugin enumeration. Using the publicly available POC, the attacker sends an HTTP GET request to the exposed REST API endpoint and receives the full file activity log in the response. … |
| Remediation | Update the File Manager WordPress plugin to version 6.9.1 or later, which introduces proper authorization checks on the affected REST API route - this is the definitive fix per the WPScan advisory at https://wpscan.com/vulnerability/972bf72f-08c4-41ec-b6e9-2d6083d21734/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit WordPress plugin inventory to identify all installations of File Manager plugin and document current versions; immediately disable the plugin on any instances running versions prior to 6.9.1 if update testing cannot be completed immediately. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in File Manager
View allThe File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitra
Remote code execution in the WordPress File Manager Pro plugin (versions up to and including 8.3.4) allows authenticated
The File Manager and File Manager Pro plugins for WordPress are vulnerable to Directory Traversal in versions up to, and
OS command injection in a family of popular WordPress file-manager plugins - FileOrganizer (before 1.1.9), Advanced File
Missing authorization controls in the File Manager WordPress plugin before version 6.9.1 allow any authenticated user -
Missing capability checks in the File Manager WordPress plugin before version 6.9.1 expose the entire WordPress installa
mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fm_backups directory with a .htacce
The File Manager WordPress plugin before 6.3 does not restrict the file managers root directory, allowing an administrat
The File Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including,
In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the endpoint
The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_f
Directory traversal vulnerability in ELECOM File Manager all versions allows remote attackers to create an arbitrary fil
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today