File Manager Plugin EUVD-2026-55040

Exploitation requires only that the File Manager plugin (any version below 6.9.1) is installed and active on the target WordPress site - no authentication, no user interaction, no special server configuration, and no non-default settings are required. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms unauthenticated remote exploitation against any accessible WordPress instance with the plugin active. Exploitation is limited to sites with this specific plugin installed; default WordPress installations are unaffected. Impact is strictly read-only: the attacker can read the file activity log but cannot write files, execute code, or modify site content through this vulnerability alone. The value of the exposed data (usernames and paths) depends on whether those usernames have reuse potential and whether the paths reveal exploitable structure.

The CVSS 3.1 score of 7.5 reflects genuinely unauthenticated, low-complexity network access with high confidentiality impact, and the vector is well-aligned with the description - there is no conflict to flag here. However, the 'High' confidentiality impact warrants calibration: what is exposed is an activity log (file operation types, paths, usernames), not credentials, private keys, or customer data directly. This makes the real-world severity moderate rather than critical - the primary risk is reconnaissance enabling chained attacks such as username enumeration for credential stuffing or filesystem path discovery to target directory traversal or file inclusion vulnerabilities. EPSS at 0.16% (5th percentile) indicates very low automated exploitation at time of analysis, despite a publicly available POC. The absence from CISA KEV further supports that exploitation is not widespread. Real-world priority is elevated (patch promptly) but does not warrant emergency incident response unless the WordPress site handles sensitive data or administrator usernames have value in the attacker's broader campaign.

An unauthenticated attacker identifies a WordPress site running File Manager below 6.9.1 via version fingerprinting or plugin enumeration. Using the publicly available POC, the attacker sends an HTTP GET request to the exposed REST API endpoint and receives the full file activity log in the response. The attacker extracts administrator usernames for use in targeted brute-force or credential-stuffing campaigns, and maps internal filesystem paths to support follow-on exploitation such as directory traversal or local file inclusion attempts.