What is CVE-2026-17540?
CVE-2026-17540 is an improper authorization vulnerability in the File Manager WordPress plugin before version 6.9.1, allowing any authenticated user like a subscriber to read and delete arbitrary files under the WordPress installation directory, which could expose the site's configuration. It is recommended to update to the latest version of the plugin.
Azərbaycanca: CVE-2026-17540, 6.9.1-dən əvvəlki File Manager WordPress pluginində fayl idarəetmə əmrləri üçün səlahiyyət yoxlanışının düzgün aparılmamasıdır; bu, abunəçi kimi istənilən autentifikasiya olunmuş istifadəçiyə WordPress qovluğundakı ixtiyari faylları oxumağa və silməyə imkan verir, sayt konfiqurasiyasının ifşasına səbəb ola bilər. Pluginin ən son versiyasına yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-863
FAQ2
Which versions of the File Manager plugin are affected by CVE-2026-17540?
The vulnerability affects the File Manager WordPress plugin versions before 6.9.1.
What unauthorized actions can an authenticated user perform by exploiting this vulnerability?
Any authenticated user, like a subscriber, can read and delete arbitrary files under the WordPress installation directory.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.