CVE-2026-17541 WP File Manager CVE debrief

Who should care

Site administrators using the File Manager WordPress plugin should prioritize reviewing file access logs for potential unauthorized access and ensure the plugin is updated to version 6.9.1 or later. Security teams should also review the official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Technical summary

The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log. This discloses file operations performed on the site, the paths involved, and the name of the user who performed them. Site administrators should verify the plugin version and review file access logs for potential unauthorized access.

Defensive priority

Site administrators should prioritize reviewing file access logs for potential unauthorized access.

Recommended defensive actions

• Review file access logs for potential unauthorized access
• Update the File Manager WordPress plugin to version 6.9.1 or later
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record was published on 2026-08-10T07:16:49.580Z. Limited information is available about the vulnerability. The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them. Site administrators should verify the plugin version and review file access logs for potential unauthorized access.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.