Advanced File Manager EUVD-2026-103420

Exploitation requires the target to run the WPExperts Advanced File Manager plugin (file-manager-advanced) at version 5.4.14 or earlier on a reachable WordPress site, and to send requests to the plugin action(s) whose access-control/authorization checks are missing or incorrectly configured. The official vector indicates no special privileges (PR:N) and no user interaction, but as a WordPress Missing Authorization (broken access control) issue, realistic exploitation frequently depends on holding a low-privileged authenticated account that can reach the plugin's handlers - defenders should confirm whether the vulnerable endpoint is exposed to unauthenticated requests or only to logged-in low-role users. Limiting factors: impact is capped at partial integrity and availability (no confidentiality loss), and the site must actually have this plugin installed and activated at an affected version.

This is a moderate-severity Missing Authorization flaw (CWE-862) in the WordPress Advanced File Manager plugin, rated CVSS 6.5 with a network vector (AV:N), low complexity (AC:L), no privileges (PR:N) and no user interaction (UI:N), but limited impact (C:N/I:L/A:L - no confidentiality loss, only partial integrity and availability). No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of network reachability and no-auth per the official vector would normally elevate priority, but the limited impact (no data disclosure, only partial integrity/availability) and absence of exploitation signals place this below critical. CONFLICT TO VERIFY: the official vector states PR:N (unauthenticated), yet CWE-862 Missing Authorization in WordPress plugins commonly requires at least a low-privileged authenticated account (e.g., subscriber) to reach the vulnerable action - the Patchstack 'Broken Access Control' classification often implies an authenticated actor escalating beyond their role. Treat the no-auth claim with caution and verify against the Patchstack advisory before assuming fully unauthenticated exploitation.

An attacker with network access to a WordPress site running Advanced File Manager ≤5.4.14 sends requests to a plugin endpoint whose authorization checks are missing or misconfigured, performing file-management actions they should not be permitted to execute. Because impact is limited to partial integrity and availability (I:L/A:L), the attacker could alter or disrupt managed files rather than fully compromise the site or read sensitive data. No public exploit code is identified, so exploitation would require independent development against the plugin's access-control logic.