CVE-2026-15991: 
WordPress Analyse et atténuation des vulnérabilités

CVE-2026-15991 is an arbitrary file deletion and read vulnerability in the File Manager plugin for WordPress (by bitpressadmin/mndpsingh287), caused by insufficient file path validation in the connector function. It affects all plugin versions from 6.0 through 6.9 and was published on August 6, 2026, with Wordfence as the assigning authority. Exploitation can lead to remote code execution by deleting critical files such as wp-config.php. It carries a CVSS v3.1 base score of 8.8 (High) (Wordfence, EUVD).

The root cause is a Missing Authorization flaw (CWE-862) arising from a discrepancy in how the elFinder library reads the cmd parameter. elFinder's bind() registration reads the command exclusively from $_POST, so the rm.pre permission handler is never registered when cmd=rm or cmd=file is passed via the URL query string. However, the elFinder dispatcher reads from the merged $_GET + $_POST superglobal ($_REQUEST), causing it to execute the rm or file command without any authorization check against a volume that defaults to WordPress's ABSPATH. This allows an attacker to craft a POST request with the destructive command in the query string, bypassing all permission hooks entirely (Wordfence, WP Trac - elFinder class, WP Trac - Connector).

Any authenticated user with subscriber-level access or above can read and delete arbitrary files anywhere within the WordPress installation root (ABSPATH), including sensitive files such as wp-config.php, theme files, and plugin files. Deletion of wp-config.php triggers WordPress's installation wizard on the next page load, allowing an attacker to reconfigure the database connection and achieve full remote code execution and complete server compromise. This vulnerability poses a critical risk to confidentiality, integrity, and availability of the affected WordPress site and potentially the underlying server (Wordfence, Feedly).

1. Reconnaissance: Identify WordPress sites running the File Manager plugin (versions 6.0–6.9) by checking plugin metadata via /wp-content/plugins/file-manager/readme.txt or using tools like WPScan.
2. Obtain low-privilege account: Register or use an existing subscriber-level (or higher) WordPress account on the target site.
3. Authenticate: Log in to obtain a valid WordPress session cookie and nonce.
4. Craft the malicious request: Send a POST request to the File Manager's AJAX endpoint (e.g., wp-admin/admin-ajax.php?action=connector&cmd=rm) with cmd=rm placed in the URL query string rather than the POST body. Include the target file path (e.g., wp-config.php mapped to its elFinder hash) in the POST body.
5. Bypass permission handler: Because elFinder's bind() reads cmd only from $_POST, the rm.pre permission handler is never registered. The dispatcher reads cmd from $_REQUEST (merged GET+POST) and executes the rm command unchecked.
6. Delete wp-config.php: The file is deleted from the server, causing WordPress to enter setup mode on the next request.
7. Achieve RCE: Navigate to the WordPress installation wizard, supply attacker-controlled database credentials, and gain administrative access — enabling arbitrary PHP code execution via theme/plugin editors or direct file upload (Wordfence, WP Trac - Controller).

• Network: Unusual POST requests to wp-admin/admin-ajax.php with action=connector and cmd=rm or cmd=file in the URL query string (not the POST body); requests originating from low-privilege user sessions targeting file paths outside the plugin's intended scope.
• Logs: WordPress/web server access logs showing POST requests to the connector endpoint with query parameters cmd=rm or cmd=file; HTTP 200 responses to such requests from subscriber-level accounts.
• File System: Unexpected absence of wp-config.php or other core WordPress files; new or modified wp-config.php with unfamiliar database credentials; unexpected files uploaded to wp-content/ directories shortly after the deletion event.
• Process/Application: WordPress entering installation/setup mode (redirects to wp-admin/setup-config.php); new WordPress admin accounts created after the deletion event; unexpected plugin or theme file modifications.

The vendor released a patch in version 6.9.1 of the File Manager plugin; administrators should update immediately via the WordPress plugin dashboard (WP Trac Changeset). If immediate patching is not possible, disable or deactivate the File Manager plugin entirely. As an additional hardening measure, restrict file system permissions on wp-config.php (e.g., chmod 400) and implement server-level rules (e.g., WAF or .htaccess) to block POST requests to the connector endpoint containing cmd=rm or cmd=file in the query string. Monitor server logs for anomalous requests to the AJAX connector endpoint from low-privilege accounts.

The vulnerability was disclosed by Wordfence, which serves as the CVE assigning authority and published the initial advisory. Automated threat intelligence aggregators including Radar Offseq, VulDB, CVEFeed, and Vulners indexed the vulnerability within hours of publication, indicating rapid community awareness. No notable independent researcher commentary or significant social media discussion has been identified beyond standard aggregation at this time.