File Manager CVE-2026-17542

Exploitation requires a valid WordPress account at subscriber level or higher - the lowest default role, typically obtainable via open user registration on public-facing sites. The File Manager plugin must be installed and active on the target installation; no special plugin configuration or non-default setting beyond activation is required to trigger the vulnerability. The affected surface is a single connector endpoint that unconditionally processes requests without invoking WordPress capability checks. Limiting factors include: the mandatory authenticated session (even minimal subscriber credentials are required, ruling out fully unauthenticated mass exploitation); the file type restriction on downloads, which is limited to archives and documents rather than arbitrary files such as PHP sources; and sites with user registration disabled and no existing low-privilege accounts are substantially less exposed, though the vulnerability cannot be fully mitigated without upgrading to version 6.9.1.

The NVD-assigned CVSS vector (AV:N/AC:L/PR:N/UI:N) conflicts directly with the vulnerability description, which requires an authenticated user at minimum subscriber level - the PR:N assignment appears to be an error that overstates the unauthenticated attack surface and should be verified against the vendor patch notes. Adjusting for the correct PR:L, the realistic CVSS base score drops from 7.5 to approximately 6.5. EPSS at 0.15% (5th percentile) is notably low and suggests the vulnerability has not yet attracted mass automated scanning, but the existence of a publicly available exploit from WPScan significantly lowers the barrier to opportunistic abuse. No CISA KEV listing is present, meaning confirmed in-the-wild active exploitation has not been formally tracked. The combination of a public exploit and a widely deployed WordPress plugin means that even a mid-sized municipal IT team in mielec should treat this as urgent if their WordPress installation permits subscriber self-registration. SSVC signals indicate exploitation is technically simple with low complexity and low required skill, but the authentication prerequisite meaningfully moderates automated scanning risk compared to a fully unauthenticated flaw.

An attacker registers a free subscriber account on a target WordPress site running the vulnerable File Manager plugin - or uses previously obtained low-privilege credentials - then directly invokes the unprotected connector endpoint, which returns directory listings of the entire WordPress installation root without any authorization check. The attacker enumerates directories and downloads accessible archives or documents, potentially recovering database passwords from wp-config.php backups, private uploads, or sensitive documents stored within the WordPress tree. A publicly available exploit from WPScan lowers the technical bar for this attack significantly.