The File Manager WordPress plugin versions prior to 6.9.1 contain an authorization bypass vulnerability in one of its REST API endpoints. This flaw allows unauthenticated attackers to read the file activity log, disclosing sensitive information such as the operations performed on files, the file paths accessed, and the usernames of the users who performed these actions. This constitutes an information exposure vulnerability categorized under CWE-200. The CVSS v3.1 base score is 7.5, reflecting high impact on confidentiality with no impact on integrity or availability. There is no vendor advisory or patch information available at this time.

The vulnerability exposes sensitive information about file operations on the affected WordPress site, including file paths and user identities, to unauthenticated attackers. This information disclosure can aid attackers in further reconnaissance or targeted attacks. There is no direct impact on system integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the REST API endpoints or disabling the File Manager plugin if feasible to prevent unauthorized access to the file activity log.