The vulnerability is a missing authorization check in the WPExperts Advanced File Manager plugin that lets an authenticated user with insufficient privileges execute the file manager code. This allows the attacker to read, upload, modify, or delete files on the WordPress installation that should remain protected, potentially exposing sensitive data or enabling further compromise. The weakness is categorized as CWE-862, unauthorized access to privileged resources.

WPExperts Advanced File Manager plugin versions up to 5.4.14, including all releases from the earliest available data to 5.4.14, are affected. WordPress sites running any of these versions are vulnerable until the plugin is upgraded to at least 6.0.0.

The CVSS v3 score is 6.5, indicating moderate severity. No EPSS data or KEV listing suggests exploit activity is currently unknown, but the flaw can be exploited through the web application once a user gains access to the WordPress admin interface. The required conditions are an authenticated WordPress account and navigation to the plugin’s page, therefore the risk is medium to low for unauthenticated attackers but significant for targeted attackers.