/Vulnerability Library

WordPress Advanced File Manager < 5.4.13 - Arbitrary File Read

CVE-2026-11565
Early Release

Description

The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access (as low as Subscriber) to read arbitrary files on the server.

Severity

High

CVSS Score

8.5

Affected Product

file-manager-advanced

Published Date

October 22, 2026

Template Author

anirbala98

CVE-2026-11565.yaml
8.5Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVE ID:
cve-2026-11565
CWE ID:
cwe-862

References

https://wpscan.com/vulnerability/5e03858d-db0b-4b65-99cc-eb01ad4195e9/https://nvd.nist.gov/vuln/detail/CVE-2026-11565https://wordpress.org/plugins/file-manager-advanced/

Remediation Steps

Update to version 5.4.13 or later.