CVE-2026-110365: WordPress Advanced File Manager plugin <= 5.4.14 - Broken Access Control vulnerability
Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced File Manager: from n/a through 5.4.14.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Advanced File Managerto a version that resolves this vulnerability.Fixed in 6.0.0
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The CVSS vector indicates that exploitation can be performed remotely with low attack complexity, without privileges or user interaction.
What security impact can exploitation have?
The reported impact is limited to integrity and availability; confidentiality impact is listed as none. The vulnerability could allow unauthorized changes or disruption, depending on the affected access-control configuration.
Which plugin versions are affected?
Advanced File Manager versions through 5.4.14 are affected. The affected range is listed as from an unspecified earlier version through 5.4.14.