CVE-2026-17541: File Manager WordPress Info Disclosure

CVE-2026-17541 Overview

CVE-2026-17541 affects the File Manager WordPress plugin in versions before 6.9.1. The plugin exposes a REST API route without authorization checks. Unauthenticated attackers can query this route to read the plugin's file activity log. The disclosed data includes file operations performed on the site, the file paths involved, and the usernames of the actors who performed them. The issue is categorized as an information exposure weakness [CWE-200].

Critical Impact
Remote attackers can read file activity telemetry from affected sites without credentials, exposing site structure, administrative usernames, and recent file operations.

Affected Products

File Manager WordPress plugin versions prior to 6.9.1
WordPress sites running the vulnerable plugin with default REST API exposure
Any hosting environment permitting anonymous access to /wp-json/ endpoints

Discovery Timeline

2026-08-10 - CVE-2026-17541 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-17541

Vulnerability Analysis

The File Manager plugin registers a REST API route that returns the plugin's internal file activity log. The route lacks a permission_callback that validates the caller's capability or authentication state. As a result, requests to the endpoint succeed regardless of the requester's identity.

The activity log records administrative file operations performed through the plugin. Each log entry contains the operation type, the absolute or relative file path, and the WordPress username that initiated the action. Exposing this data helps attackers map the site's directory structure and enumerate valid administrator accounts for follow-on attacks.

The network attack vector requires no privileges and no user interaction. Exploitation reduces to a single HTTP GET request against the vulnerable REST route. The impact is limited to confidentiality; the flaw does not permit modification of files or denial of service.

Root Cause

The root cause is a missing authorization check on a REST API route. WordPress requires plugin authors to supply a permission_callback when registering routes with register_rest_route(). When this callback is absent or returns true unconditionally, the endpoint becomes publicly accessible. This is a classic broken access control pattern [CWE-200].

Attack Vector

An attacker sends an unauthenticated HTTP request to the plugin's REST API activity log route on any affected WordPress site. The server returns the raw activity log as JSON. The attacker parses the response to extract usernames, file paths, and timestamps. Refer to the WPScan Vulnerability Report for the specific endpoint details.

Detection Methods for CVE-2026-17541

Indicators of Compromise

Unauthenticated HTTP GET requests to /wp-json/ routes registered by the File Manager plugin
Access log entries showing repeated REST API calls from a single IP without a prior authentication cookie
Requests to REST endpoints returning JSON payloads containing file path and username fields

Detection Strategies

Inspect WordPress access logs for anonymous requests targeting File Manager REST routes
Correlate REST API responses with response sizes larger than typical unauthenticated endpoints return
Alert on external IPs that enumerate multiple /wp-json/ paths in short intervals

Monitoring Recommendations

Enable verbose logging on the WordPress REST API layer, including caller identity and route name
Forward web server and WordPress logs to a centralized SIEM for anomaly detection
Monitor for post-disclosure follow-on activity such as credential stuffing against enumerated usernames

How to Mitigate CVE-2026-17541

Immediate Actions Required

Update the File Manager WordPress plugin to version 6.9.1 or later on every affected site
Audit WordPress access logs for prior unauthenticated requests to the plugin's REST routes
Rotate credentials for administrator accounts whose usernames may have been exposed

Patch Information

The vendor addressed the issue in File Manager version 6.9.1 by adding an authorization check to the affected REST API route. Site operators should upgrade through the WordPress plugin dashboard or via WP-CLI. Confirm the installed version after the upgrade by reviewing the plugin metadata. Additional details are available in the WPScan Vulnerability Report.

Workarounds

Restrict access to /wp-json/ routes via a web application firewall rule until the plugin is updated
Deactivate the File Manager plugin on sites where an immediate update is not feasible
Require authentication on all REST API traffic using a WordPress hardening plugin that enforces is_user_logged_in() checks

bash

# Update the File Manager plugin using WP-CLI
wp plugin update wp-file-manager --version=6.9.1
wp plugin list --name=wp-file-manager --fields=name,status,version