CVE-2026-110365 WPExperts CVE debrief

Who should care

Defenders responsible for WordPress installations with the Advanced File Manager plugin should assess exposure and prioritize verification and remediation.

Why it matters

Defenders should care about CVE-2026-110365 because it affects the Advanced File Manager plugin for WordPress, potentially allowing unauthorized actions. Relevant roles include defenders responsible for WordPress installations with this plugin. Supported consequences include verification of plugin version and access control configuration, and remediation priority for affected versions. Evidence limits include reliance on CVE and NVD records.

• Potential unauthorized actions on the plugin
• Verification of plugin version and access control configuration
• Remediation priority for affected versions

Technical summary

The Advanced File Manager plugin for WordPress, versions up to 5.4.14, is vulnerable to a Missing Authorization issue, allowing attackers to exploit incorrectly configured access control security levels. This vulnerability has a CVSS score of 6.5 and is classified as MEDIUM severity. Defenders should prioritize verifying and updating the Advanced File Manager plugin to prevent potential unauthorized actions.

Defensive priority

Defenders should prioritize verifying and updating the Advanced File Manager plugin to prevent potential unauthorized actions.

Recommended defensive actions

• Verify the Advanced File Manager plugin version and update to a patched version if necessary
• Review and configure access control security levels for the plugin
• Monitor for potential unauthorized actions on the plugin

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and affected versions. The Advanced File Manager plugin for WordPress, versions up to 5.4.14, is vulnerable to a Missing Authorization issue. Defenders should verify plugin version and access control configuration, and prioritize remediation for affected versions. The CVE and NVD records provide source-grounded information on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.