Vulnerability · Published Aug 19, 2026 · Assigned by WPScan
CVE-2026-11565Advanced File Manager < 5.4.13 - Authenticated Arbitrary File Read and Write via fma_load_fma_ui
High 8.5
In plain English
A high-severity security flaw in Advanced File Manager from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Official description
The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access (as low as Subscriber) to read arbitrary files on the server — including sensitive configuration files — and to overwrite existing non-PHP files, which can be leveraged to compromise administrator accounts and the whole site.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Advanced File Manager | 0 – before 5.4.13 |
References
- https://wpscan.com/vulnerability/5e03858d-db0b-4b65-99cc-eb01ad4195e9/ exploit, vdb-entry, technical-description