What is the CVSS score of CVE-2026-17542?

CVE-2026-17542 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-17542?

Yes, a public proof-of-concept exploit is available for CVE-2026-17542. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-17542?

Within 24 hours, identify all WordPress installations using the File Manager plugin and document their current versions. Within 7 days, upgrade File Manager plugin to version 6.9.1 or later across all environments and verify successful deployment. Within 30 days, audit system logs for unauthorized access to sensitive directories on previously vulnerable installations, rotate all database credentials and service account passwords as a precautionary measure, and implement web server-level access restrictions on the WordPress installation directory.

File Manager CVE-2026-17542

Q: Which versions of File Manager are affected by CVE-2026-17542?

The File Manager WordPress plugin before version 6.9.1 exposes the entire WordPress installation directory to any authenticated user, including low-privilege subscribers, creating risk of disclosure…. A patch is available.

EUVD-2026-55039 HIGH

Information Exposure (CWE-200)

2026-08-10 WPScan

Information Disclosure WordPress File Manager

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Description explicitly requires subscriber-level authentication, correcting NVD PR:N to PR:L; no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 20:28 vuln.today

CVSS changed

Aug 10, 2026 - 20:22 NVD

7.5 (HIGH)

Patch available

Aug 10, 2026 - 08:02 EUVD

CVE Published

Aug 10, 2026 - 06:00 cve.org

HIGH 7.5

CVE Published

Aug 10, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, such as a subscriber, to browse the entire WordPress installation directory and download files of certain types from it, including archives and documents which may contain sensitive data.

Articles & Coverage 1

News 8 New WordPress Vulnerabilities - 1 Critical, 7 High, All With POC Aug 11, 2026

AnalysisAI

Missing capability checks in the File Manager WordPress plugin before version 6.9.1 expose the entire WordPress installation directory to any authenticated user, including low-privilege subscribers. Exploitation allows traversal of server-side directories and download of sensitive file types such as archives and documents, which frequently contain database credentials, configuration backups, and private documents. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Delivery

Identify active File Manager plugin on target site

Exploit

Send authenticated request to unprotected connector endpoint

Execution

Enumerate WordPress installation directory structure

Persist

Identify sensitive archives and documents

Impact

Download files to extract credentials or confidential data

Access

Delivery

Identify active File Manager plugin on target site

Exploit

Send authenticated request to unprotected connector endpoint

Execution

Enumerate WordPress installation directory structure

Persist

Identify sensitive archives and documents

Impact

Download files to extract credentials or confidential data

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid WordPress account at subscriber level or higher - the lowest default role, typically obtainable via open user registration on public-facing sites. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD-assigned CVSS vector (AV:N/AC:L/PR:N/UI:N) conflicts directly with the vulnerability description, which requires an authenticated user at minimum subscriber level - the PR:N assignment appears to be an error that overstates the unauthenticated attack surface and should be verified against the vendor patch notes. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker registers a free subscriber account on a target WordPress site running the vulnerable File Manager plugin - or uses previously obtained low-privilege credentials - then directly invokes the unprotected connector endpoint, which returns directory listings of the entire WordPress installation root without any authorization check. The attacker enumerates directories and downloads accessible archives or documents, potentially recovering database passwords from wp-config.php backups, private uploads, or sensitive documents stored within the WordPress tree. …
Remediation	Update the File Manager WordPress plugin to version 6.9.1 or later, which introduces proper capability checks on the affected connector endpoint; this is the vendor-released patch confirmed by WPScan at https://wpscan.com/vulnerability/d17f3de9-b0f9-4bbd-8a57-18cda9d43d79/ and by ENISA EUVD-2026-55039. … Detailed patch versions, workarounds, and compensating controls in full report.