CVE-2023-3814

Advanced File Manager < 5.1.1 - Admin+ Arbitrary File/Folder Access

The Advanced File Manager WordPress plugin before 5.1.1 does not adequately authorize its usage on multisite installations, allowing site admin users to list and read arbitrary files and folders on the server.

Affected

Advanced File Manager

CVSS v3.1 NVD

4.9 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

EPSS

0.62% chance of exploitation in the next 30 days, 49th percentile

Published

2023-09-04

Updated

2025-03-06

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/ca954ec6-6ebd-4d72-a323-570474e2e339

References

• CVE Record
• NVD entry