The Advanced File Manager plugin for WordPress contains a missing authorization flaw (CWE‑862) that lets a user dismiss important security notices without proper permissions. By dismissing these notices, an attacker can suppress warning messages and potentially gain access to functionality that is normally protected, effectively reducing security controls and allowing privileged actions to be performed by unauthorized users.

Any WordPress site that installs the Saad Iqbal Advanced File Manager plugin, specifically versions up through and including 5.3.1, is vulnerable. The issue affects only the plugin, not the core WordPress installation, but any user who can load the plugin’s administrative interface may exploit the bug.

The overall severity is moderate, with a CVSS score of 5.3 and an EPSS indicate very low exploitation probability (<1%). The vulnerability is not listed in CISA’s KEV catalog, suggesting it has not yet been widely exploited. An attacker with any authenticated role that can access the plugin, or potentially a compromised account, may use the notice dismissal endpoint to bypass restrictions. The attack vector is likely through the web interface of the plugin, requiring only standard user access privileges.