CVE-2026-11565: Advanced File Manager < 5.4.13 - Authenticated Arbitrary File Read and Write via fma_load_fma_ui
The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access (as low as Subscriber) to read arbitrary files on the server — including sensitive configuration files — and to overwrite existing non-PHP files, which can be leveraged to compromise administrator accounts and the whole site.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Advanced File Manager (WordPress plugin)to a version that resolves this vulnerability.Fixed in 5.4.13 - Configuration
Ensure only administrator accounts are granted file-manager access in the plugin (since pre-5.4.13 lacks capability checks and roles as low as Subscriber may be able to read/write files via AJAX actions).
Advanced File Manager (WordPress plugin) file-manager access = restrict to administrator-only
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any WordPress role that an administrator has granted access to the plugin’s file-manager functionality can exploit it, including Subscriber-level users. Users without that granted file-manager access are not identified as affected by the provided data.
Is a default installation affected?
The issue requires an administrator to grant a role access to the file manager. The provided data does not establish that Subscriber or other low-privilege roles receive that access by default.
What can an attacker do after gaining file-manager access?
They can read arbitrary server files, including sensitive configuration files, and overwrite existing non-PHP files. The overwrite capability can be used to compromise administrator accounts and potentially the entire site.