File Management Flaw in WordPress Plugin Exposes Sensitive Data
CVE-2026-17540
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 10 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-17540?
The File Manager plugin for WordPress prior to version 6.9.1 contains a significant flaw in its authorization processes, enabling authenticated users, including subscribers, to execute file management commands without appropriate permissions. This vulnerability allows unauthorized access to sensitive files within the WordPress installation directory, which can result in the exposure of critical site configurations and enable potential denial-of-service scenarios.
Affected Version(s)
File Manager 0 < 6.9.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.