The File Manager plugin for WordPress contains a missing authorization vulnerability that permits authenticated users to delete arbitrary files, threatening the integrity of the host system.

This vulnerability involves a missing authorization check (CWE-862) within the connector function, allowing an authenticated attacker with low privileges to delete arbitrary files on the server.

An attacker capable of deleting arbitrary files can cause severe service disruption, potentially deleting critical configuration files or site content. With a CVSS score of 8.8, this vulnerability poses a high risk of total system failure and loss of critical business data.

Immediate Action: Update the File Manager plugin to version 6.9.1 or later immediately.

Proactive Monitoring: Review file system changes and audit logs for unexpected file deletions or modifications occurring through the plugin interface.

Compensating Controls: Utilize a Web Application Firewall (WAF) to restrict access to sensitive backend files and monitor for suspicious traffic directed at the connector and ajax endpoints.

Public Exploit Available: Unknown

Update the File Manager plugin to version 6.9.1 as soon as possible to mitigate the risk of arbitrary file deletion. Administrators should verify the integrity of their file system after applying the patch and review user access logs to ensure no unauthorized activity occurred during the window of exposure.