The WP Table Manager plugin for WordPress suffers from a missing capability check on thewptm_getFolders AJAX action in all versions up to 4.1.3. This authorization bypass allows authenticated users with Subscriber-level privileges or above to enumerate and read arbitrary file names and directories on the server. The vulnerability is classified as CWE-862 (Missing Authorization). It has a CVSS 3.1 base score of 4.3, reflecting low impact on confidentiality and no impact on integrity or availability. No known exploits in the wild have been reported, and no patch or official remediation guidance is currently available.

An attacker with at least Subscriber-level access can exploit this vulnerability to read arbitrary file names and directory listings, potentially disclosing sensitive information stored on the server. There is no impact on data integrity or service availability. The information disclosure could aid further attacks but is limited to authenticated users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access to trusted users only and monitor for suspicious activity related to thewptm_getFolders AJAX action. Consider disabling or restricting the WP Table Manager plugin if possible to reduce exposure.