CVE-2026-110365

MediumCVSS 6.5

Published: 18/10/2026(UTC)Updated: 19/10/2026(UTC)Translated: 18/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

The Advanced File Manager plugin for WordPress (up to version 5.4.14) has a Missing Authorization vulnerability, enabling exploitation of incorrectly configured access control security levels. An attacker can access file management functions without proper permissions.

Risk Assessment

This may allow viewing, modifying, or deleting files on the server, leading to data leakage or site destruction. In extreme cases, it enables remote code execution.

Recommendation

Immediately update the Advanced File Manager plugin to a version newer than 5.4.14. Check for unauthorized file access.

Other vulnerabilities in Advanced File Manager

CVE-2026-15009Medium
The Advanced File Manager plugin for WordPress up to version 5.4.12 is vulnerable to Stored Cross-Site Scripting via the 'soundFile' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires control of a domain with a prefix matching the backend URL and an authenticated admin visiting the page with the File Manager open.

Original NVD description (English source)

Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced File Manager: from n/a through 5.4.14.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS