CVE-2026-17541

The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them.

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.32% chance of exploitation in the next 30 days, 24th percentile

Published

2026-08-10

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/972bf72f-08c4-41ec-b6e9-2d6083d21734/

References

• CVE Record
• NVD entry

Related

• CVE-2026-17540
• CVE-2026-17542
• CVE-2026-17533
• CVE-2026-17543
• CVE-2026-17532
• CVE-2026-17544