WordPress File Manager Arbitrary File Read/Delete via Missing Authorization (CVE-2026-15991)

Vulnerability Overview Vulnerability Name: File Manager 6.0 - 6.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read and Deletion via 'cmd' Query Parameter CVE ID: CVE-2026-15991 CVSS Score: 8.8 (High) Publish Date: August 5, 2026 Last Updated: August 6, 2026 Researcher: daroo Affected Scope Software Type: Plugin Software Name: file-manager (view on wordpress.org) Affected Versions: 6.0 - 6.9 Fixed Version: 6.9.1 Remediation Recommendation: Upgrade to version 6.9.1 or later. Vulnerability Description The File Manager plugin contains an arbitrary file deletion vulnerability due to insufficient file path validation in the connector function. This vulnerability allows an authenticated attacker (with Subscriber-level access or higher) to read and delete arbitrary files on the server, potentially leading to Remote Code Execution (RCE). This vulnerability can be triggered when deleting files with a right parenthesis in their name (such as wp-config.php). Reference Links plugins.trac.wordpress.org Additional Information Wordfence Intelligence: Provides free personal and commercial API access to query the vulnerability database. Wordfence WordPress Plugin: Provides real-time vulnerability notification features. Recent Vulnerabilities Bit File Manager: Multiple versions contain various vulnerabilities, including Stored XSS, Arbitrary File Creation/Upload/Deletion, Remote Code Execution, etc. File Manager: Contains vulnerabilities such as Authentication Bypass, Arbitrary File Access, and PHP Object Injection. Copyright Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved License: CVE Usage License provided by MITRE Corporation. Contact Information Technical Support: 9am-6pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 365 days a year, 1-hour response time Other Links Terms of Service: Terms of Service Privacy Policy and Notice at Collection: Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information Social Media Facebook: Facebook Twitter: Twitter LinkedIn: LinkedIn Instagram: Instagram Subscription Subscribe to News and Updates: Enter email address to subscribe. Footer Links Products: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central Support: Documentation, Learning Center, Free Support, Premium Support News: Blog, In The News, Vulnerability Advisories About: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form Additional Information Wordfence Intelligence: Provides free personal and commercial API access to query the vulnerability database. Wordfence WordPress Plugin: Provides real-time vulnerability notification features. Recent Vulnerabilities Bit File Manager: Multiple versions contain various vulnerabilities, including Stored XSS, Arbitrary File Creation/Upload/Deletion, Remote Code Execution, etc. File Manager: Contains vulnerabilities such as Authentication Bypass, Arbitrary File Access, and PHP Object Injection. Copyright Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved License: CVE Usage License provided by MITRE Corporation. Contact Information Technical Support: 9am-6pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 365 days a year, 1-hour response time Other Links Terms of Service: Terms of Service Privacy Policy and Notice at Collection: Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information Social Media Facebook: Facebook Twitter: Twitter LinkedIn: LinkedIn Instagram: Instagram Subscription Subscribe to News and Updates: Enter email address to subscribe. Footer Links Products: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central Support: Documentation, Learning Center, Free Support, Premium Support News: Blog, In The News, Vulnerability Advisories About: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form Additional Information Wordfence Intelligence: Provides free personal and commercial API access to query the vulnerability database. Wordfence WordPress Plugin: Provides real-time vulnerability notification features. Recent Vulnerabilities Bit File Manager: Multiple versions contain various vulnerabilities, including Stored XSS, Arbitrary File Creation/Upload/Deletion, Remote Code Execution, etc. File Manager: Contains vulnerabilities such as Authentication Bypass, Arbitrary File Access, and PHP Object Injection. Copyright Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved License: CVE Usage License provided by MITRE Corporation. Contact Information Technical Support: 9am-6pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 365 days a year, 1-hour response ti

Goal Reached Thanks to every supporter — we hit 100%!

WordPress File Manager Arbitrary File Read/Delete via Missing Authorization (CVE-2026-15991)

More from this source