CVE-2026-17542: File Manager WordPress Info Disclosure

CVE-2026-17542 Overview

CVE-2026-17542 is an information disclosure vulnerability in the File Manager WordPress plugin before version 6.9.1. The plugin fails to perform capability checks on one of its file manager connector endpoints. Any authenticated user, including low-privileged subscribers, can browse the entire WordPress installation directory. Attackers can download files of certain types, including archives and documents that may contain sensitive data. The flaw maps to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Authenticated low-privilege users can enumerate and exfiltrate arbitrary files from the WordPress installation, exposing backups, configuration data, and documents containing credentials or PII.

Affected Products

File Manager WordPress plugin versions prior to 6.9.1
WordPress sites permitting subscriber-level account registration
WordPress deployments with the plugin active and any authenticated user tier

Discovery Timeline

2026-08-10 - CVE-2026-17542 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-17542

Vulnerability Analysis

The File Manager plugin exposes a connector endpoint that handles filesystem operations for the plugin's administrative interface. The endpoint accepts authenticated requests but omits a current_user_can() capability check before processing directory listing and file download commands. Any user session with a valid nonce, including a subscriber account, can invoke the connector to enumerate directories and retrieve files. The plugin restricts downloads to certain file types, but archives (.zip, .tar, .gz) and documents (.pdf, .docx, .xlsx) remain accessible. These file types frequently contain database backups, configuration exports, and business documents.

Root Cause

The root cause is missing authorization on a privileged endpoint. The plugin authenticates the request but never verifies that the calling user holds the manage_options or equivalent capability required to operate the file manager. This authorization gap classifies as a broken access control defect under [CWE-200].

Attack Vector

Exploitation requires network access and a valid low-privilege WordPress account. The attacker registers or compromises a subscriber account, obtains a valid AJAX nonce from any authenticated page, and issues requests to the connector endpoint with commands such as open for directory listing and file for download. No user interaction from an administrator is needed.

See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-17542

Indicators of Compromise

Unexpected authenticated admin-ajax.php or plugin connector requests originating from subscriber accounts
Directory traversal parameters (cmd=open, cmd=file, target=) in File Manager connector requests from non-administrator users
Outbound transfers of archive or document files from /wp-content/, /wp-admin/, or the site root to subscriber sessions
Access log entries showing repeated enumeration of parent directories such as .. or root filesystem paths

Detection Strategies

Review web server access logs for authenticated calls to the File Manager plugin's connector endpoint from users lacking administrator roles
Correlate WordPress user role metadata with plugin endpoint invocations to flag capability mismatches
Alert on downloads of .zip, .sql, .pdf, or .docx files served through plugin AJAX handlers rather than direct URL fetches

Monitoring Recommendations

Enable WordPress audit logging to capture user role, request URI, and query parameters for every AJAX call
Forward web and PHP error logs to a centralized SIEM and retain them for retrospective hunting
Monitor new user registrations and correlate account creation with subsequent plugin endpoint activity

How to Mitigate CVE-2026-17542

Immediate Actions Required

Update the File Manager plugin to version 6.9.1 or later on all WordPress installations
Audit existing subscriber and low-privilege accounts and remove any that are unrecognized
Rotate credentials, API keys, and secrets stored in files that may have been exfiltrated

Patch Information

The vendor addressed the missing authorization by adding capability checks to the connector endpoint in File Manager plugin version 6.9.1. Site operators should upgrade through the WordPress plugin dashboard or by deploying the updated package from the official plugin repository. Verify the installed version via the WordPress admin plugins page after the upgrade.

Workarounds

Deactivate the File Manager plugin until the patched version is deployed
Disable open user registration and restrict subscriber-level accounts to trusted users
Deploy a web application firewall rule blocking non-administrator requests to the plugin's connector endpoint
Restrict access to wp-admin/admin-ajax.php by IP allowlist where operationally feasible

bash

# Example WAF rule blocking File Manager connector for non-admin sessions
SecRule REQUEST_URI "@contains admin-ajax.php" \
  "chain,deny,status:403,id:1017542,msg:'Block File Manager connector for low-priv users'"
  SecRule ARGS:action "@rx ^(mk_file_folder_manager|file_folder_manager)$" \
    "chain"
    SecRule REQUEST_HEADERS:Cookie "!@rx wordpress_logged_in_[a-f0-9]+=.*administrator"