Arbitrary File Deletion Vulnerability in File Manager Plugin for WordPress

CVE-2026-15991

What is CVE-2026-15991?

The File Manager plugin for WordPress contains a security flaw that allows authenticated attackers with subscriber-level access or higher to perform arbitrary file deletion. This is due to insufficient validation of file paths when executing commands via the connector function. Attackers can exploit the vulnerability to read and delete sensitive files on the server, increasing the risk of remote code execution if critical files—like wp-config.php—are removed. This critical oversight occurs because the command handling is improperly managed between the superglobal arrays, leading to unfiltered command execution.

References