CVE-2026-15991: File Manager Path Traversal Vulnerability

CVE-2026-15991 Overview

CVE-2026-15991 is an arbitrary file deletion vulnerability in the File Manager plugin for WordPress, affecting versions 6.0 through 6.9. The flaw stems from insufficient file path validation in the connector function that processes elFinder commands. Authenticated attackers with subscriber-level access or higher can read and delete arbitrary files on the server. Deleting critical files such as wp-config.php can lead to remote code execution by forcing WordPress into an installation state controlled by the attacker. The vulnerability is classified as Missing Authorization [CWE-862].

Critical Impact
Subscriber-level attackers can delete wp-config.php and other sensitive files, escalating to full site takeover and remote code execution.

Affected Products

WordPress File Manager plugin version 6.0
WordPress File Manager plugin versions 6.1 through 6.8
WordPress File Manager plugin version 6.9

Discovery Timeline

2026-08-06 - CVE-2026-15991 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-15991

Vulnerability Analysis

The File Manager plugin bundles the elFinder file browser library and exposes its connector through a WordPress AJAX hook. The AccessControlProvider component registers a rm.pre permission handler that is intended to gate destructive commands like rm (remove) and file (read). This handler restricts which files authenticated users may touch.

The bypass exists because two different code paths inspect the request differently. The bind registration in FileManagerController reads the command name exclusively from $_POST. The elFinder dispatcher, however, reads the command from the merged $_GET + $_POST superglobal. An attacker who submits a POST request with the command in the query string bypasses handler registration entirely while still triggering command execution.

Root Cause

The root cause is inconsistent request parsing between authorization and dispatch logic. Because the rm.pre permission handler is never registered when the command arrives via $_GET, the dispatcher executes rm or file against a volume rooted at ABSPATH without any access checks. This is a classic missing authorization defect [CWE-862] compounded by superglobal parsing asymmetry.

Attack Vector

Exploitation requires an authenticated account with subscriber-level access, which is trivially obtainable on sites permitting open registration. The attacker sends a POST request to the plugin's AJAX endpoint with cmd=rm or cmf=file embedded in the URL query string. The dispatcher then reads or deletes files anywhere under the WordPress root. Deleting wp-config.php triggers WordPress to prompt for a fresh installation, which an attacker can complete to obtain administrative access and execute arbitrary PHP code. Technical references are available in the Wordfence Vulnerability Analysis and the WordPress FileManagerController Code.

Detection Methods for CVE-2026-15991

Indicators of Compromise

POST requests to wp-admin/admin-ajax.php containing cmd=rm or cmf=file in the URL query string while the POST body specifies a different or missing command.
Missing or truncated wp-config.php, .htaccess, or core PHP files followed by unexpected WordPress installation prompts.
New administrator accounts created shortly after suspicious file-manager AJAX activity.
Subscriber accounts issuing requests to action=mk_file_folder_manager or the File Manager connector endpoint.

Detection Strategies

Inspect web server access logs for POST requests where cmd or cmf parameters appear in the query string, which is not the plugin's normal usage pattern.
Correlate File Manager AJAX activity with low-privilege user sessions to identify subscribers invoking file operations.
Monitor file integrity of wp-config.php and other files under ABSPATH for unauthorized deletions.

Monitoring Recommendations

Enable WordPress audit logging for plugin AJAX actions and user role changes.
Deploy file integrity monitoring on the WordPress installation directory with alerting on deletion events.
Track subscriber-level account registrations and their subsequent request patterns for anomalies.

How to Mitigate CVE-2026-15991

Immediate Actions Required

Update the File Manager plugin to version 6.9.1 or later, which introduces consistent command parsing across the authorization and dispatch layers.
Disable open user registration if subscriber accounts are not operationally required.
Audit existing WordPress accounts and remove untrusted subscriber-level users.
Verify integrity of wp-config.php and other critical files, restoring from backup if tampering is detected.

Patch Information

The vendor released a fix in the WordPress FileManager Version Update that ships as version 6.9.1. The corresponding source change is documented in the WordPress FileManagerController Changeset. Administrators should apply the update through the WordPress plugin dashboard or via WP-CLI.

Workarounds

If patching is not immediately possible, deactivate and remove the File Manager plugin until it can be updated.
Restrict access to wp-admin/admin-ajax.php from untrusted networks using a web application firewall rule that blocks requests containing cmd=rm or cmf=file in the query string.
Set the WordPress option users_can_register to false to prevent adversaries from obtaining subscriber accounts.

bash

# Update the File Manager plugin using WP-CLI
wp plugin update file-manager --version=6.9.1

# Disable open registration as a hardening measure
wp option update users_can_register 0

# Verify plugin version after update
wp plugin get file-manager --field=version