Advanced File Manager EUVD-2026-107081

Exploitation requires (1) a WordPress site running Advanced File Manager between 5.4.13 and before 6.0.0; (2) an attacker account that an administrator has explicitly granted file-manager access to - this is NOT available to anonymous or default low-privilege users (maps to PR:L); and (3) a victim, typically an administrator, actively opening or previewing the stored malicious file (UI:R). The specific weakness is the plugin's failure to correctly determine whether an uploaded file is genuinely an SVG before sanitising it, so a file that evades SVG classification keeps its embedded script. Limiting factors: the dependence on administrator-delegated access, the need for victim interaction, and that fully-trusted-only file-manager deployments remove the untrusted-uploader vector entirely.

This is a stored cross-site scripting (CWE-79) flaw in the Advanced File Manager WordPress plugin arising from an SVG-detection failure during sanitisation. The provided CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H, 7.1 High) signals network reach but requires some privilege (PR:L), user interaction (UI:R) and higher attack complexity (AC:H). A public exploit exists (WPScan) and a vendor patch is available, but this CVE is NOT on CISA KEV and no EPSS score was provided in the input, so there is no evidence of active, widespread exploitation - exploit-code availability must not be conflated with in-the-wild attack. The honest read: this is a meaningful but conditional risk rather than an emergency. It is not unauthenticated RCE; it needs a user who was already granted file-manager access by an administrator AND a victim (ideally an administrator) to open the malicious file. I disagree with the input's A:H / AC:H framing: the primary realistic impact is account/session/admin-context compromise via script execution (confidentiality and integrity), not availability, and the sanitisation bypass is reliable once known (closer to AC:L). Prioritise patching for sites that delegate file-manager roles to non-fully-trusted users; lower urgency where only trusted administrators hold that capability.

An administrator grants a lower-privileged user file-manager access. That user uploads a file crafted so the plugin fails to recognise it as an SVG, so the embedded script is not stripped and is stored. When an administrator later opens or previews that file in the dashboard, the script executes in the admin's authenticated browser session, enabling actions such as creating rogue admin accounts or injecting further payloads. A public proof-of-concept for this flaw is available via WPScan.