AUGUST 16, 2026
Live Feed
Back to database
Case File

CVE-2026-17541

HIGH · CVSS 7.5 EPSS 0.32%

Source: NVD + CISA KEV + EPSS · Published 2026-08-10 · Last synced 2026-08-16

CyberRota Analysis

AI-Generated

The File Manager plugin for WordPress versions prior to 6.9.1 lacks proper authorization checks on a REST API route, enabling unauthenticated users to access sensitive file activity logs. This vulnerability can lead to the exposure of file operations, including user actions and file paths, potentially compromising site security. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this risk.

CVE
CVE-2026-17541
Severity
HIGH
CVSS
7.5
EPSS
0.32%
WordPress

Original NVD Description

The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them.