{"id":"CVE-2026-79627","kind":"vulnerability","aliases":["CVE-2026-79627"],"related":[],"title":"Advanced File Manager WordPress plugin: stored SVG script runs in admin browsers","description":"The Advanced File Manager  WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone who opens it, including an administrator.","summary":"The Advanced File Manager WordPress plugin before 6.0.0 fails to recognise some uploaded files as SVG, so its sanitiser does not strip script from them. A user with file-manager access can store a file whose script runs in the browser of anyone who opens it, including an administrator.","severity":"high","cvss":7.1,"epss":0.00205,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["no-file-manager-users","plugin-at-6.0.0-or-later"],"how_to_check":"- Check the installed Advanced File Manager plugin version in the WordPress admin Plugins screen or with `wp plugin get advanced-file-manager --field=version`\n- Look for stored SVG files in the plugin's upload directory that contain script elements","fix":"- Update the Advanced File Manager plugin to `6.0.0` or later\n- Until updated, restrict file-manager access to trusted users only","status":"open","published_at":"2026-10-21T06:16:49+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:31:57+00:00","updated_at":"2026-10-25T03:31:57+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:31:57Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Advanced File Manager plugin to `6.0.0` or later\n- Until updated, restrict file-manager access to trusted users only","reach":"internet","title":"Advanced File Manager WordPress plugin: stored SVG script runs in admin browsers","impact":"high","summary":"The Advanced File Manager WordPress plugin before 6.0.0 fails to recognise some uploaded files as SVG, so its sanitiser does not strip script from them. A user with file-manager access can store a file whose script runs in the browser of anyone who opens it, including an administrator.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Script runs in an administrator's browser, enabling account takeover of the site.","analyst_note":"Confirm the exact affected version range and whether a patched release note or advisory names the fixed sanitiser behaviour; check the NVD page for the CVSS vector.","how_to_check":"- Check the installed Advanced File Manager plugin version in the WordPress admin Plugins screen or with `wp plugin get advanced-file-manager --field=version`\n- Look for stored SVG files in the plugin's upload directory that contain script elements","needs_analyst":true,"not_affected_if":["plugin-at-6.0.0-or-later","no-file-manager-users"],"who_is_affected":"Sites running the Advanced File Manager plugin before 6.0.0 where some users have been granted file-manager access by an administrator. The exposure is strongest where administrators browse the stored files through the plugin. Sites without this plugin, or with it at 6.0.0 or later, can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000649,"input_tokens":3364,"output_tokens":625,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-79627':15A,18A '6.0.0':34B,84C 'access':58B,105C 'admin':11A 'administr':76B,108C,132C 'advanc':1A,28B,78C 'allow':99C 'anyon':70B,126C 'browser':12A,68B,124C 'contain':113C 'correct':87C 'cve':13A,16A 'determin':88C 'fail':35B 'file':2A,29B,40B,56B,62B,79C,92C,103C,112C 'file-manag':55B,102C 'grant':101C 'host':22B 'includ':74B,130C 'manag':3A,30B,57B,80C,104C 'open':72B,128C 'packag':19B 'plugin':5A,26B,32B,82C 'recognis':37B 'run':9A,65B,121C 'sanitis':45B,97C 'script':8A,49B,64B,114C 'self':21B 'self-host':20B 'store':6A,60B,91C,110C 'strip':48B,118C 'svg':7A,42B,95C 'upload':39B 'user':53B,100C 'whether':89C 'whose':63B 'wordpress':4A,23B,25B,31B,81C 'wordpress-plugin':24B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Advanced File Manager plugin before 6.0.0 where some users have been granted file-manager access by an administrator. The exposure is strongest where administrators browse the stored files through the plugin. Sites without this plugin, or with it at 6.0.0 or later, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T06:16:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79627","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79627","severity":null,"published_at":"2026-10-21T06:16:49+00:00","modified_at":"2026-10-21T18:37:38+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-79627","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79627","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}