CVE-2026-17542: CWE-200 Information Exposure in File Manager
The File Manager WordPress plugin before version 6.9.1 contains an information exposure vulnerability. It does not perform capability checks on a file manager connector endpoint, allowing any authenticated user, including low-privileged roles like subscribers, to browse the entire WordPress installation directory and download certain file types. This may lead to unauthorized access to sensitive data stored in archives and documents.
AI Analysis
Technical Summary
CVE-2026-17542 is an information exposure vulnerability (CWE-200) in the File Manager WordPress plugin prior to version 6.9.1. The vulnerability arises because the plugin fails to enforce capability checks on one of its file manager connector endpoints. As a result, any authenticated user, regardless of privilege level, can browse the WordPress installation directory and download files such as archives and documents. This exposure could lead to unauthorized disclosure of sensitive information contained within these files. The CVSS v3.1 base score is 7.5, indicating a high severity impact primarily due to confidentiality loss. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.
Potential Impact
Unauthorized authenticated users can access and download files from the WordPress installation directory, potentially exposing sensitive data contained in archives and documents. This compromises confidentiality but does not affect integrity or availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles and permissions to minimize exposure. Monitor for updates from the plugin vendor regarding patches or official mitigations.
CVE-2026-17542: CWE-200 Information Exposure in File Manager
Description
The File Manager WordPress plugin before version 6.9.1 contains an information exposure vulnerability. It does not perform capability checks on a file manager connector endpoint, allowing any authenticated user, including low-privileged roles like subscribers, to browse the entire WordPress installation directory and download certain file types. This may lead to unauthorized access to sensitive data stored in archives and documents.
CVSS v3.1
Score 7.5high
Affected software
File Manager
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-17542 is an information exposure vulnerability (CWE-200) in the File Manager WordPress plugin prior to version 6.9.1. The vulnerability arises because the plugin fails to enforce capability checks on one of its file manager connector endpoints. As a result, any authenticated user, regardless of privilege level, can browse the WordPress installation directory and download files such as archives and documents. This exposure could lead to unauthorized disclosure of sensitive information contained within these files. The CVSS v3.1 base score is 7.5, indicating a high severity impact primarily due to confidentiality loss. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.
Potential Impact
Unauthorized authenticated users can access and download files from the WordPress installation directory, potentially exposing sensitive data contained in archives and documents. This compromises confidentiality but does not affect integrity or availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles and permissions to minimize exposure. Monitor for updates from the plugin vendor regarding patches or official mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-07-27T10:00:26.882Z
- State
- PUBLISHED
Threat ID: 6a7972b0bf8831d5392fb045
Added to database: 08/10/2026, 06:41:52 UTC
Last enriched: 08/17/2026, 15:29:00 UTC
Last updated: 09/24/2026, 01:47:40 UTC
Views: 48
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.