{"id":"CVE-2026-110365","kind":"vulnerability","aliases":["CVE-2026-110365"],"related":[],"title":"WordPress Advanced File Manager plugin: missing authorization check exposes file access","description":"Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced File Manager: from n/a through 5.4.14.","summary":"The Advanced File Manager WordPress plugin (file-manager-advanced) through version 5.4.14 lacks an authorization check, so access controls are not enforced as intended. The sources do not state exactly which files or actions an attacker can reach.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["file-manager-advanced","package","wordpress","wordpress-plugin"],"not_affected_if":["plugin-deactivated","plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get file-manager-advanced --field=version`\n- Confirm whether the plugin is active on the site\n- Review which user roles can open the file manager","fix":"- Update the Advanced File Manager plugin to a version newer than `5.4.14`, as published by WPExperts\n- If no fixed version is available, deactivate the plugin until one is released","status":"open","published_at":"2026-10-18T11:16:36+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:57:35+00:00","updated_at":"2026-10-25T03:57:35+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:57:35Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Advanced File Manager plugin to a version newer than `5.4.14`, as published by WPExperts\n- If no fixed version is available, deactivate the plugin until one is released","reach":"internet","title":"WordPress Advanced File Manager plugin: missing authorization check exposes file access","impact":"medium","summary":"The Advanced File Manager WordPress plugin (file-manager-advanced) through version 5.4.14 lacks an authorization check, so access controls are not enforced as intended. The sources do not state exactly which files or actions an attacker can reach.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","file-manager-advanced"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unauthorized users may read or change files on the site","analyst_note":"Check the NVD entry and the WPExperts changelog for the fixed version and the exact missing check, and whether unauthenticated users can reach it.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get file-manager-advanced --field=version`\n- Confirm whether the plugin is active on the site\n- Review which user roles can open the file manager","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-deactivated"],"who_is_affected":"WordPress sites running Advanced File Manager at version 5.4.14 or earlier are affected. Sites where the plugin is not installed or is deactivated can skip it. The sources do not say which role or configuration is needed to reach the flaw.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000625,"input_tokens":3308,"output_tokens":589,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110365':14A,17A '-2026':13A,16A '5.4.14':39B,94C 'access':11A,45B,82C 'action':61B 'advanc':2A,21B,28B,36B,71C,77C,88C 'affect':87C 'allow':78C 'attack':63B 'author':7A,42B,67C 'check':8A,43B 'configur':81C 'control':46B,83C 'cve':12A,15A 'enforc':49B 'exact':57B 'exploit':79C 'expos':9A 'file':3A,10A,19B,29B,34B,59B,72C,75C,89C 'file-manager-advanc':18B,33B,74C 'incorrect':80C 'intend':51B 'issu':86C 'lack':40B 'levels.this':85C 'manag':4A,20B,30B,35B,73C,76C,90C 'miss':6A,66C 'n/a':92C 'packag':22B 'plugin':5A,26B,32B 'reach':65B 'secur':84C 'sourc':53B 'state':56B 'version':38B 'vulner':68C 'wordpress':1A,23B,25B,31B 'wordpress-plugin':24B 'wpexpert':70C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running Advanced File Manager at version 5.4.14 or earlier are affected. Sites where the plugin is not installed or is deactivated can skip it. The sources do not say which role or configuration is needed to reach the flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T11:16:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110365","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110365","severity":null,"published_at":"2026-10-18T11:16:36+00:00","modified_at":"2026-10-19T20:17:51+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}