EUVD-2026-51919
GHSA-mxw9-rxrv-85f3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-exploitable with no authentication; AC:L because valid attachment_id is trivially enumerable; read-only traversal yields no integrity or availability impact.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.15 via the 'uamgetfile' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. This is possible because when attachment_url_to_postid() returns 0 for a traversal path, the plugin falls back to the global post set by a valid ?attachment_id parameter supplied by the attacker, causing the access check to pass against a legitimate public attachment while the file streamed is the attacker-chosen path.
AnalysisAI
Directory traversal in the User Access Manager WordPress plugin (all versions ≤ 2.3.15) permits unauthenticated remote attackers to read arbitrary files from the server filesystem by exploiting a logic flaw in the plugin's file-serving access check. By pairing a path traversal string in the uamgetfile parameter with a valid public attachment ID, an attacker causes the plugin's fallback mechanism to approve access against a legitimate public attachment while streaming the attacker-chosen file path - effectively bypassing all access controls. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the zero-prerequisite exploitation conditions (CVSS AV:N/AC:L/PR:N/UI:N) mean that sensitive files such as wp-config.php and .env are exposed on any affected site with the plugin's file protection feature active.
Technical ContextAI
The User Access Manager (UAM) plugin extends WordPress with role-based content and file access restrictions, routing protected file downloads through its own handler keyed by the uamgetfile query parameter. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). In the file-serving pipeline - spanning BaseControllerTrait.php (lines 22-50), RedirectController.php (lines 50-99, 119-141, 245-252), FileHandler.php (lines 79-124, 270-294), and UserAccessManager.php (lines 512-516) - the plugin calls WordPress's attachment_url_to_postid() to resolve the requested path to a post ID before performing an access check. When a traversal path such as ../../wp-config.php is supplied, attachment_url_to_postid() returns 0 because no real attachment maps to it. Rather than rejecting the request, the plugin falls back to the post object set by a separate, attacker-controlled attachment_id query parameter. If that ID points to any publicly accessible attachment, the access check passes on the legitimate post - but FileHandler.php then streams the original traversal-specified file to the requester. No CPE string was provided in the input data; the affected software is tracked as the 'user-access-manager' WordPress plugin.
RemediationAI
The primary remediation is to update the User Access Manager plugin to the version incorporating patch changeset 3628895 (https://plugins.trac.wordpress.org/changeset/3628895/user-access-manager); the exact patched release version number is not specified in the available input data and should be confirmed against the WordPress plugin repository before deploying. Administrators should install the latest available version from the WordPress.org plugin directory. As an interim workaround, disabling the plugin's file protection feature removes the vulnerable uamgetfile code path entirely - the trade-off is that file access restrictions enforced by UAM will not be applied during the interim period, leaving protected files accessible to all visitors. A web server-level compensating control (e.g., an nginx location block or Apache RewriteRule blocking requests containing the uamgetfile parameter) can further reduce exposure, though this may break legitimate protected file downloads for authorized users. Wordfence advisory: https://www.wordfence.com/threat-intel/vulnerabilities/id/4e88efe0-ffad-4d66-bb03-3f3a9dcbe5b1.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today