CVE-2026-17540: unknown file manager Improper Access Control
Vulnerability summary
CVE-2026-17540 is a high (CVSS 8.8) Improper Access Control vulnerability in unknown file manager. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 35.3% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 6.9.1.
Timeline
- 10-08-2026PublishedVulnerability first disclosed.
- 11-08-2026Last modifiedVulnerability information updated.
Description
The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's configuration secrets and to denial of service.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- wordfenceSource6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NDiffers
EPSS trend
Probability
0.42%
Chance of exploitation in the next 30 days
Percentile
35%
Versus all other CVEs
30-day change
+0.14 pp
From 0.28% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Affected systems
Unknown1 product
- file manager< 6.9.1
Wordpress1 product
- file-manager≤ 6.9.0 (fixed in 6.9.1)
2 vendors · 2 products