CVE-2026-17540 Overview
CVE-2026-17540 is a broken access control vulnerability in the File Manager WordPress plugin before version 6.9.1. The plugin fails to properly authorize its file management commands. Any authenticated user, including a low-privileged subscriber, can read and delete arbitrary files under the WordPress installation directory. Exploitation can disclose site configuration secrets stored in files such as wp-config.php and cause denial of service by deleting critical files. The flaw is tracked under CWE-284: Improper Access Control.
Critical Impact
Authenticated subscribers can read and delete arbitrary files on the WordPress site, leading to secret disclosure and denial of service.
Affected Products
- File Manager WordPress plugin versions prior to 6.9.1
- WordPress sites permitting subscriber-level registration with the plugin installed
- Any WordPress deployment where the vulnerable File Manager plugin is active
Discovery Timeline
- 2026-08-10 - CVE-2026-17540 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-17540
Vulnerability Analysis
The File Manager WordPress plugin exposes AJAX endpoints that execute file management commands including read, write, copy, move, and delete. In versions before 6.9.1, these command handlers do not verify that the requesting user has administrative privileges. The plugin accepts requests from any authenticated session, including subscribers, and processes file operations against paths under the WordPress installation directory. An attacker with a low-privileged account can invoke the file-read command against wp-config.php to extract database credentials, authentication salts, and other secrets. The same attacker can invoke the delete command against core WordPress files or theme and plugin assets to disable the site.
Root Cause
The root cause is missing authorization checks on the plugin's file management command dispatcher. The handlers verify that the request originates from an authenticated user but do not confirm the user has the manage_options capability or an equivalent administrative role. This maps to CWE-284: Improper Access Control.
Attack Vector
The attack requires network access and a valid low-privileged WordPress account such as a subscriber. Many WordPress sites allow open user registration, which supplies the required authentication level. The attacker sends crafted AJAX requests to the plugin's file management endpoint with commands such as file read or delete and a target path. The plugin executes the command without an authorization check and returns file contents or performs the destructive operation. See the WPScan Vulnerability Report for technical details.
Detection Methods for CVE-2026-17540
Indicators of Compromise
- POST requests to admin-ajax.php referencing the File Manager plugin action from non-administrator user sessions
- Access log entries showing subscriber or contributor accounts issuing file management commands
- Missing or truncated wp-config.php, .htaccess, or core WordPress files without a corresponding administrator action
- Unexpected reads of sensitive files followed by outbound connections to attacker-controlled hosts
Detection Strategies
- Inventory WordPress sites for the File Manager plugin and identify installations below version 6.9.1
- Correlate WordPress user role data with admin-ajax.php request logs to find low-privileged users invoking file operations
- Alert on any AJAX action tied to the File Manager plugin executed by accounts lacking the administrator role
- Monitor file integrity for wp-config.php and WordPress core directories
Monitoring Recommendations
- Forward WordPress access logs and PHP error logs to a centralized logging platform for correlation
- Track new user registrations and flag accounts that immediately issue plugin AJAX requests
- Baseline normal administrator file management activity and alert on deviations
How to Mitigate CVE-2026-17540
Immediate Actions Required
- Update the File Manager WordPress plugin to version 6.9.1 or later on all sites
- Audit WordPress user accounts and remove or downgrade unused subscriber accounts
- Rotate database credentials, authentication salts, and API keys stored in wp-config.php if compromise is suspected
- Restore any deleted files from a known-good backup and validate WordPress core integrity
Patch Information
The vendor addressed the issue in File Manager plugin version 6.9.1 by adding capability checks to the file management command handlers. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Deactivate the File Manager plugin until the patched version can be installed
- Disable open user registration by unsetting the users_can_register option in WordPress general settings
- Restrict access to wp-admin/admin-ajax.php using web application firewall rules that block File Manager actions from non-administrator sessions
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
