Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control… (CVE-2026-110365)

CVE-2026-110365 describes a missing authorization vulnerability in WPExperts Advanced File Manager (file-manager-advanced) affecting versions up to 5.4.14. The issue arises from incorrectly configured access control security levels, which can be exploited to perform unauthorized actions. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) indicates network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality impact, but integrity and availability impacts are low and high respectively.

Exploitation of this vulnerability can lead to unauthorized modification or disruption of the affected system's operations, impacting integrity and availability. There is no confidentiality impact reported. The medium severity score reflects the potential for attackers to cause service disruption or data integrity issues without needing privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor WPExperts advisories for updates. Until a fix is available, restrict access to the affected plugin and review access control configurations to minimize exposure.