A critical authorization vulnerability in the File Manager WordPress plugin allows authenticated users to read or delete files, potentially leading to full site compromise.

This is an improper access control vulnerability (CWE-284) occurring within the plugin file management functions. The vulnerability allows any authenticated user, including low-privileged subscribers, to bypass capability checks and perform unauthorized file operations due to a request-source mismatch.

The vulnerability carries a CVSS score of 8.8, indicating high severity. Successful exploitation allows unauthorized parties to access sensitive configuration files, such as wp-config.php, which often contains database credentials and encryption keys. Furthermore, the ability to delete arbitrary files can result in significant service disruption or complete site defacement, posing a severe risk to business continuity and data integrity.

Immediate Action: Update the File Manager WordPress plugin to version 6.9.1 or later immediately to resolve the authorization flaw.

Proactive Monitoring: Review web server and WordPress access logs for unusual requests targeting the file management interface or unexpected deletion patterns.

Compensating Controls: If an immediate update is not feasible, disable the File Manager plugin entirely or utilize a Web Application Firewall (WAF) to block unauthorized requests to the plugin command endpoints.

Public Exploit Available: No confirmed public exploit (false).

Given the potential for complete data disclosure and service disruption, administrators should prioritize this update. Ensure that all WordPress user accounts are audited to minimize the risk of low-privileged users leveraging this flaw before the patch is applied.