File Manager
Monthly
Cross-site scripting in the WordPress File Manager plugin (below 8.0.5), FileOrganizer (below 1.2.1) and File Manager Pro (below 2.1.3) allows an unauthenticated attacker to run arbitrary JavaScript inside the session of a logged-in administrator, because the file browser these plugins embed accepts window.postMessage events from any origin that is merely a leading-string prefix of the victim site's own address. Exploitation requires the administrator to be logged in and to visit an attacker-controlled page on such a prefix origin (for example a domain whose name begins with the victim's hostname), which is reflected in the CVSS vector as UI:R with AC:H while PR:N confirms no attacker authentication is needed. Publicly available exploit code exists and the vendor has released fixes, but CISA SSVC rates exploitation as none and automatable as no, and EPSS is only 0.17% (6th percentile), so this is a conditional rather than a mass-exploitation risk.
Ekia File Manager 1.2.7 for Android ships an exported ContentProvider (com.ekia.filecontrolmanager.OpenFileProvider) that declares no android:permission, readPermission, or writePermission, so any other app on the same device can invoke it. The provider maps the caller-supplied URI path straight to a filesystem path and passes it to new File(...), letting a malicious local app make the File Manager process read, create, overwrite, or delete every file that process can reach. The issue is not in CISA KEV, EPSS is only 0.11% (2nd percentile), and no public exploit tooling was identified in the supplied data, so real-world priority depends almost entirely on whether untrusted apps can be installed on the target device.
Missing capability checks in the File Manager WordPress plugin before version 6.9.1 expose the entire WordPress installation directory to any authenticated user, including low-privilege subscribers. Exploitation allows traversal of server-side directories and download of sensitive file types such as archives and documents, which frequently contain database credentials, configuration backups, and private documents. A publicly available exploit exists per WPScan, though EPSS remains low at 0.15% (5th percentile), suggesting opportunistic rather than widespread automated exploitation at this time; no CISA KEV listing is present.
Unauthenticated information disclosure in the File Manager WordPress plugin before 6.9.1 exposes a REST API route without any authorization controls, allowing any remote user to retrieve the plugin's complete file activity log. The leaked log reveals filesystem paths within the WordPress installation and the usernames of administrators who performed file operations, providing reconnaissance data useful for chaining further attacks. A publicly available proof-of-concept exploit exists per WPScan's disclosure, though EPSS at 0.16% (5th percentile) indicates limited observed exploitation activity; the vulnerability is not listed in CISA KEV.
Missing authorization controls in the File Manager WordPress plugin before version 6.9.1 allow any authenticated user - including low-privilege subscribers - to read and delete arbitrary files under the WordPress installation directory. The weakness exposes sensitive configuration secrets such as database credentials stored in wp-config.php, and enables deliberate denial of service through file deletion. A publicly available exploit exists per WPScan reporting, though EPSS remains very low (0.14%, 4th percentile), suggesting targeted rather than broadly automated exploitation at time of analysis.
Arbitrary file deletion and read access in the File Manager WordPress plugin (versions 6.0-6.9) allows any authenticated user with subscriber-level access or above to delete or read arbitrary server files, including wp-config.php, which can be leveraged for remote code execution. The flaw is rooted in a parameter-source discrepancy in elFinder's connector: the bind registration for the rm.pre permission handler reads exclusively from $_POST, while the dispatcher reads from the merged $_GET+$_POST superglobal - allowing an attacker to inject cmd=rm or cmf=file via the URL query string of a POST request, entirely bypassing authorization checks. A patched version (6.9.1) has been released per the WordPress plugin repository changeset; no public exploit has been identified at time of analysis, though the Wordfence disclosure provides sufficient technical specificity for exploitation.
OS command injection in a family of popular WordPress file-manager plugins - FileOrganizer (before 1.1.9), Advanced File Manager (before 5.4.12), File Manager Pro (before 2.1.1), and File Manager (before 8.0.4) - lets authenticated users inject arbitrary shell commands through an unescaped parameter passed to the ImageMagick convert CLI during image operations. Reported by WPScan, publicly available exploit code exists, though EPSS is modest at 0.52% (40th percentile) and CISA SSVC records exploitation as 'none'. Exploitation is real but gated: the server must fall back to the ImageMagick convert binary because neither the PHP imagick nor GD extension is installed.
The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Unauthenticated information disclosure in the File Manager WordPress plugin (versions 7.2.2 through before 8.0.5) lets remote attackers download database backup archives that the plugin leaves reachable in its directory, leaking every user's email address and password hash. The flaw only lands on servers that do not honor the plugin directory's .htaccess protection - nginx hosts or Apache with AllowOverride disabled - and it also depends on a backup archive having been generated and being reachable at a predictable or fixed filename, which is why the vendor and the independent assessment both score it AC:H and confidentiality-only (CWE-200, CVSS 5.9). Publicly available exploit code exists per WPScan, but there is no confirmed active exploitation (CISA SSVC: Exploitation none) and EPSS is low at 0.14% (3rd percentile), so exposure is best modeled as a realistic targeted/lateral-movement risk on non-compliant web server configurations rather than a mass-exploitation event.
An authenticated arbitrary file upload vulnerability in the /uploads/ endpoint of CMS Made Simple Foundation File Manager v2.2.22 allows attackers with Administrator privileges to execute arbitrary. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The File Manager Pro plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 8.3.9. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The File Manager Pro plugin for WordPress is vulnerable to arbitrary backup file downloads and uploads due to missing file type validation via the 'mk_file_folder_manager_shortcode' ajax action in. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The File Manager Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.3.9. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Bit File Manager - 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
The Bit File Manager plugin for WordPress is vulnerable to Remote Code Execution in versions 6.0 to 6.5.5 via the 'checkSyntax' function. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
The File Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.2.5 via the fm_download_backup function. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity.
The File Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.4. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The File Manager and File Manager Pro plugins for WordPress are vulnerable to Directory Traversal in versions up to, and including version 7.2.1 (free version) and 8.3.4 (Pro version) via the target. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.2.1 due to insufficient randomness in the backup filenames, which use a. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required.
Remote code execution in the WordPress File Manager Pro plugin (versions up to and including 8.3.4) allows authenticated attackers with subscriber-level access to upload arbitrary files via the mk_check_filemanager_php_syntax AJAX endpoint, leading to full server compromise. Publicly available exploit code exists, and the high EPSS score of 13.31% (94th percentile) indicates significant real-world exploitation likelihood. The flaw is patched in version 8.3.5, which introduces a missing capability check.
Deserialization of Untrusted Data vulnerability in File Manager by Bit Form Team File Manager - 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager.2.7. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable. No vendor patch available.
The File Manager WordPress plugin before 6.3 does not restrict the file managers root directory, allowing an administrator to set a root outside of the WordPress root directory, giving access to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the endpoint /wp-admin/admin.php?page=wp_file_manager_properties when a payload is submitted. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Directory traversal vulnerability in ELECOM File Manager all versions allows remote attackers to create an arbitrary file or overwrite an existing file in a directory which can be accessed with the. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fm_backups directory with a .htaccess file. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_file_manager request because set_transient is used in file_folder_manager.php. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
inc/logger.php in the Giribaz File Manager plugin before 5.0.2 for WordPress logged activity related to the plugin in /wp-content/uploads/file-manager/log.txt. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Cross-site scripting in the WordPress File Manager plugin (below 8.0.5), FileOrganizer (below 1.2.1) and File Manager Pro (below 2.1.3) allows an unauthenticated attacker to run arbitrary JavaScript inside the session of a logged-in administrator, because the file browser these plugins embed accepts window.postMessage events from any origin that is merely a leading-string prefix of the victim site's own address. Exploitation requires the administrator to be logged in and to visit an attacker-controlled page on such a prefix origin (for example a domain whose name begins with the victim's hostname), which is reflected in the CVSS vector as UI:R with AC:H while PR:N confirms no attacker authentication is needed. Publicly available exploit code exists and the vendor has released fixes, but CISA SSVC rates exploitation as none and automatable as no, and EPSS is only 0.17% (6th percentile), so this is a conditional rather than a mass-exploitation risk.
Ekia File Manager 1.2.7 for Android ships an exported ContentProvider (com.ekia.filecontrolmanager.OpenFileProvider) that declares no android:permission, readPermission, or writePermission, so any other app on the same device can invoke it. The provider maps the caller-supplied URI path straight to a filesystem path and passes it to new File(...), letting a malicious local app make the File Manager process read, create, overwrite, or delete every file that process can reach. The issue is not in CISA KEV, EPSS is only 0.11% (2nd percentile), and no public exploit tooling was identified in the supplied data, so real-world priority depends almost entirely on whether untrusted apps can be installed on the target device.
Missing capability checks in the File Manager WordPress plugin before version 6.9.1 expose the entire WordPress installation directory to any authenticated user, including low-privilege subscribers. Exploitation allows traversal of server-side directories and download of sensitive file types such as archives and documents, which frequently contain database credentials, configuration backups, and private documents. A publicly available exploit exists per WPScan, though EPSS remains low at 0.15% (5th percentile), suggesting opportunistic rather than widespread automated exploitation at this time; no CISA KEV listing is present.
Unauthenticated information disclosure in the File Manager WordPress plugin before 6.9.1 exposes a REST API route without any authorization controls, allowing any remote user to retrieve the plugin's complete file activity log. The leaked log reveals filesystem paths within the WordPress installation and the usernames of administrators who performed file operations, providing reconnaissance data useful for chaining further attacks. A publicly available proof-of-concept exploit exists per WPScan's disclosure, though EPSS at 0.16% (5th percentile) indicates limited observed exploitation activity; the vulnerability is not listed in CISA KEV.
Missing authorization controls in the File Manager WordPress plugin before version 6.9.1 allow any authenticated user - including low-privilege subscribers - to read and delete arbitrary files under the WordPress installation directory. The weakness exposes sensitive configuration secrets such as database credentials stored in wp-config.php, and enables deliberate denial of service through file deletion. A publicly available exploit exists per WPScan reporting, though EPSS remains very low (0.14%, 4th percentile), suggesting targeted rather than broadly automated exploitation at time of analysis.
Arbitrary file deletion and read access in the File Manager WordPress plugin (versions 6.0-6.9) allows any authenticated user with subscriber-level access or above to delete or read arbitrary server files, including wp-config.php, which can be leveraged for remote code execution. The flaw is rooted in a parameter-source discrepancy in elFinder's connector: the bind registration for the rm.pre permission handler reads exclusively from $_POST, while the dispatcher reads from the merged $_GET+$_POST superglobal - allowing an attacker to inject cmd=rm or cmf=file via the URL query string of a POST request, entirely bypassing authorization checks. A patched version (6.9.1) has been released per the WordPress plugin repository changeset; no public exploit has been identified at time of analysis, though the Wordfence disclosure provides sufficient technical specificity for exploitation.
OS command injection in a family of popular WordPress file-manager plugins - FileOrganizer (before 1.1.9), Advanced File Manager (before 5.4.12), File Manager Pro (before 2.1.1), and File Manager (before 8.0.4) - lets authenticated users inject arbitrary shell commands through an unescaped parameter passed to the ImageMagick convert CLI during image operations. Reported by WPScan, publicly available exploit code exists, though EPSS is modest at 0.52% (40th percentile) and CISA SSVC records exploitation as 'none'. Exploitation is real but gated: the server must fall back to the ImageMagick convert binary because neither the PHP imagick nor GD extension is installed.
The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Unauthenticated information disclosure in the File Manager WordPress plugin (versions 7.2.2 through before 8.0.5) lets remote attackers download database backup archives that the plugin leaves reachable in its directory, leaking every user's email address and password hash. The flaw only lands on servers that do not honor the plugin directory's .htaccess protection - nginx hosts or Apache with AllowOverride disabled - and it also depends on a backup archive having been generated and being reachable at a predictable or fixed filename, which is why the vendor and the independent assessment both score it AC:H and confidentiality-only (CWE-200, CVSS 5.9). Publicly available exploit code exists per WPScan, but there is no confirmed active exploitation (CISA SSVC: Exploitation none) and EPSS is low at 0.14% (3rd percentile), so exposure is best modeled as a realistic targeted/lateral-movement risk on non-compliant web server configurations rather than a mass-exploitation event.
An authenticated arbitrary file upload vulnerability in the /uploads/ endpoint of CMS Made Simple Foundation File Manager v2.2.22 allows attackers with Administrator privileges to execute arbitrary. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The File Manager Pro plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 8.3.9. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The File Manager Pro plugin for WordPress is vulnerable to arbitrary backup file downloads and uploads due to missing file type validation via the 'mk_file_folder_manager_shortcode' ajax action in. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The File Manager Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.3.9. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Bit File Manager - 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
The Bit File Manager plugin for WordPress is vulnerable to Remote Code Execution in versions 6.0 to 6.5.5 via the 'checkSyntax' function. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
The File Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.2.5 via the fm_download_backup function. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity.
The File Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.4. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The File Manager and File Manager Pro plugins for WordPress are vulnerable to Directory Traversal in versions up to, and including version 7.2.1 (free version) and 8.3.4 (Pro version) via the target. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.2.1 due to insufficient randomness in the backup filenames, which use a. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required.
Remote code execution in the WordPress File Manager Pro plugin (versions up to and including 8.3.4) allows authenticated attackers with subscriber-level access to upload arbitrary files via the mk_check_filemanager_php_syntax AJAX endpoint, leading to full server compromise. Publicly available exploit code exists, and the high EPSS score of 13.31% (94th percentile) indicates significant real-world exploitation likelihood. The flaw is patched in version 8.3.5, which introduces a missing capability check.
Deserialization of Untrusted Data vulnerability in File Manager by Bit Form Team File Manager - 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager.2.7. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable. No vendor patch available.
The File Manager WordPress plugin before 6.3 does not restrict the file managers root directory, allowing an administrator to set a root outside of the WordPress root directory, giving access to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the endpoint /wp-admin/admin.php?page=wp_file_manager_properties when a payload is submitted. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Directory traversal vulnerability in ELECOM File Manager all versions allows remote attackers to create an arbitrary file or overwrite an existing file in a directory which can be accessed with the. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fm_backups directory with a .htaccess file. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_file_manager request because set_transient is used in file_folder_manager.php. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
inc/logger.php in the Giribaz File Manager plugin before 5.0.2 for WordPress logged activity related to the plugin in /wp-content/uploads/file-manager/log.txt. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.