CVE-2026-15991 is a missing authorization vulnerability (CWE-862) in the File Manager plugin for WordPress by bitpressadmin, affecting versions 6.0 through 6.9. The vulnerability arises from improper validation of file paths in the connector function and a bypass in the command authorization logic. Specifically, the elFinder component reads commands exclusively from $_POST, bypassing the rm.pre permission handler, while the dispatcher executes commands from merged $_GET and $_POST data without proper checks. Authenticated attackers with subscriber-level privileges can exploit this to read and delete arbitrary files on the server, including critical files like wp-config.php, which can lead to remote code execution.

An attacker with subscriber-level access or higher can delete arbitrary files on the server, potentially removing critical configuration files such as wp-config.php. This can lead to remote code execution and full compromise of the affected WordPress installation. The vulnerability has a high CVSS score of 8.8, reflecting its severity and ease of exploitation given low attack complexity and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access where possible and monitor for suspicious activity related to file deletion commands. Avoid exposing the vulnerable plugin to untrusted users. Do not rely on elFinder's default permission handlers as they can be bypassed in this context.