PatchSiren cyber security CVE debrief
CVE-2026-15991 bitpressadmin CVE debrief
The File Manager plugin for WordPress has a critical vulnerability allowing arbitrary file deletion due to insufficient file path validation in versions 6.0-6.9. Authenticated attackers with subscriber-level access can delete files, potentially leading to remote code execution. This vulnerability is highly severe, with a CVSS score of 8.8, and defenders should treat it as high priority due to the potential for significant impact. The bypass is triggered by passing cmd=rm or cmf=file in the URL query string of a POST request. Defenders should verify the integrity of their file systems, especially after updates, and monitor for suspicious file deletion attempts. They should also restrict access to sensitive files and directories, and implement additional security measures such as Web Application Firewall (WAF) rules. The CVE record was published on 2026-08-06T05:16:38.930Z and has not been modified since then.
- Vendor
- bitpressadmin
- Product
- File Manager
- CVSS
- HIGH 8.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-08-06
- Original CVE updated
- 2026-08-06
- Advisory published
- 2026-08-06
- Advisory updated
- 2026-08-06
Who should care
WordPress administrators, security teams, and users of the File Manager plugin should be aware of this vulnerability. They should prioritize updating the plugin and take measures to protect against potential exploitation. This includes restricting access to sensitive files and directories, monitoring server logs for suspicious activity, and implementing additional security measures such as Web Application Firewall (WAF) rules.
Technical summary
The File Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the connector function. This allows authenticated attackers with subscriber-level access to delete arbitrary files, potentially leading to remote code execution. The vulnerability exists in plugin versions 6.0-6.9. The bypass is triggered by passing cmd=rm or cmf=file in the URL query string of a POST request.
Defensive priority
High priority due to potential for remote code execution
Recommended defensive actions
- Immediately update File Manager plugin to version 6.9.1 or later
- Restrict access to sensitive files and directories
- Monitor server logs for suspicious file deletion attempts
- Implement additional security measures such as Web Application Firewall (WAF) rules
- Conduct a thorough review of server file systems for potential unauthorized deletions
- Perform regular security audits to identify and address any other potential vulnerabilities
- Ensure that all users with subscriber-level access and above are aware of the vulnerability and its implications
Evidence notes
The vulnerability exists in File Manager plugin versions 6.0-6.9 for WordPress. Insufficient file path validation in the connector function allows authenticated attackers to delete arbitrary files. This could potentially lead to remote code execution if critical files such as wp-config.php are deleted. Defenders should verify the integrity of their file systems, especially after updates, and monitor for suspicious file deletion attempts.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-06T05:16:38.930Z and has not been modified since then.