PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-17541 WP File Manager CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-10T07:16:49.580Z and has not been modified since then. The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them. This vulnerability affects site administrators who should prioritize reviewing file access logs for potential unauthorized access. Limited information is available about the vulnerability.

Vendor
WP File Manager
Product
File Manager
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-10
Original CVE updated
2026-08-10
Advisory published
2026-08-10
Advisory updated
2026-08-10

Who should care

Site administrators using the File Manager WordPress plugin should prioritize reviewing file access logs for potential unauthorized access and ensure the plugin is updated to version 6.9.1 or later. Security teams should also review the official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Technical summary

The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log. This discloses file operations performed on the site, the paths involved, and the name of the user who performed them. Site administrators should verify the plugin version and review file access logs for potential unauthorized access.

Defensive priority

Site administrators should prioritize reviewing file access logs for potential unauthorized access.

Recommended defensive actions

  • Review file access logs for potential unauthorized access
  • Update the File Manager WordPress plugin to version 6.9.1 or later
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record was published on 2026-08-10T07:16:49.580Z. Limited information is available about the vulnerability. The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them. Site administrators should verify the plugin version and review file access logs for potential unauthorized access.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-10T07:16:49.580Z and has not been modified since then.