CVE-2026-15991: CWE-862 Missing Authorization in bitpressadmin File Manager
The File Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the connector function in all versions from 6.0 - 6.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to read and delete arbitrary files on the server, which can lead to remote code execution when the right file is deleted (such as wp-config.php). The bypass is triggered by passing cmd=rm or cmf=file in the URL query string of a POST request: elFinder's bind registration reads the command exclusively from $_POST and therefore never registers the rm.pre permission handler, while the dispatcher reads from the merged $_GET+$_POST superglobal and executes the rm or file command unchecked against a volume that defaults to ABSPATH.
AI Analysis
Technical Summary
CVE-2026-15991 is a missing authorization vulnerability (CWE-862) in the File Manager plugin for WordPress by bitpressadmin, affecting versions 6.0 through 6.9. The flaw arises from insufficient validation of file paths in the connector function and a logic bypass where the rm or file commands are executed without proper permission checks. Authenticated attackers with subscriber-level privileges can exploit this by sending POST requests with cmd=rm or cmf=file in the URL query string, leading to arbitrary file deletion. This can escalate to remote code execution if key files such as wp-config.php are deleted. The vulnerability has a CVSS 3.1 score of 8.8 (high severity) with network attack vector, low attack complexity, and no user interaction required.
Potential Impact
Authenticated users with subscriber-level access or higher can delete arbitrary files on the server hosting the WordPress site. This can lead to complete compromise of the site, including remote code execution, if critical files like wp-config.php are deleted or manipulated.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, restrict subscriber-level access where possible and monitor for suspicious POST requests containing cmd=rm or cmf=file parameters. Avoid granting unnecessary file management permissions to low-privilege users.
CVE-2026-15991: CWE-862 Missing Authorization in bitpressadmin File Manager
Description
The File Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the connector function in all versions from 6.0 - 6.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to read and delete arbitrary files on the server, which can lead to remote code execution when the right file is deleted (such as wp-config.php). The bypass is triggered by passing cmd=rm or cmf=file in the URL query string of a POST request: elFinder's bind registration reads the command exclusively from $_POST and therefore never registers the rm.pre permission handler, while the dispatcher reads from the merged $_GET+$_POST superglobal and executes the rm or file command unchecked against a volume that defaults to ABSPATH.
CVSS v3.1
Score 8.8high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-15991 is a missing authorization vulnerability (CWE-862) in the File Manager plugin for WordPress by bitpressadmin, affecting versions 6.0 through 6.9. The flaw arises from insufficient validation of file paths in the connector function and a logic bypass where the rm or file commands are executed without proper permission checks. Authenticated attackers with subscriber-level privileges can exploit this by sending POST requests with cmd=rm or cmf=file in the URL query string, leading to arbitrary file deletion. This can escalate to remote code execution if key files such as wp-config.php are deleted. The vulnerability has a CVSS 3.1 score of 8.8 (high severity) with network attack vector, low attack complexity, and no user interaction required.
Potential Impact
Authenticated users with subscriber-level access or higher can delete arbitrary files on the server hosting the WordPress site. This can lead to complete compromise of the site, including remote code execution, if critical files like wp-config.php are deleted or manipulated.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, restrict subscriber-level access where possible and monitor for suspicious POST requests containing cmd=rm or cmf=file parameters. Avoid granting unnecessary file management permissions to low-privilege users.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-07-16T20:10:30.067Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a740d08bf8831d5391e5e99
Added to database: 08/06/2026, 04:26:48 UTC
Last enriched: 08/06/2026, 04:41:22 UTC
Last updated: 08/06/2026, 18:41:24 UTC
Views: 16
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.