CVE-2026-124251: WordPress WPIDE – File Manager & Code Editor plugin <= 3.6.4 - Cross Site Request Forgery (CSRF) vulnerability

Q: What must an attacker do to exploit this issue?

The attacker must cause a victim to interact with a crafted request, as indicated by the user-interaction requirement. No attacker privileges are required.

Q: What is the potential impact if exploitation succeeds?

The reported severity vector indicates high impact to confidentiality, integrity, and availability. The issue is remotely reachable over the network and has low attack complexity.

Q: Which plugin versions are affected?

WPIDE – File Manager & Code Editor versions through 3.6.4 are affected. The available data does not identify a fixed version.

Published Nov 10, 2026

Updated

Cross-Site Request Forgery (CSRF) vulnerability in XplodedThemes WPIDE – File Manager & Code Editor wpide allows Cross Site Request Forgery.This issue affects WPIDE – File Manager & Code Editor: from n/a through 3.6.4.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade XplodedThemes WPIDE – File Manager & Code Editor to a version that resolves this vulnerability.
Fixed in 3.6.5

Event History

Nov 10, 2026

CVE Published

via MITRE·04:05 PM

Data Sourced

via MITRE·04:05 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker do to exploit this issue?

The attacker must cause a victim to interact with a crafted request, as indicated by the user-interaction requirement. No attacker privileges are required.

What is the potential impact if exploitation succeeds?

The reported severity vector indicates high impact to confidentiality, integrity, and availability. The issue is remotely reachable over the network and has low attack complexity.

Which plugin versions are affected?

WPIDE – File Manager & Code Editor versions through 3.6.4 are affected. The available data does not identify a fixed version.

CVE-2026-124251: WordPress WPIDE – File Manager & Code Editor plugin <= 3.6.4 - Cross Site Request Forgery (CSRF) vulnerability

Remediation

Event History

Frequently Asked Questions

What must an attacker do to exploit this issue?

What is the potential impact if exploitation succeeds?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to exploit this issue?

What is the potential impact if exploitation succeeds?

Which plugin versions are affected?