The File Manager plugin for WordPress permits authenticated users at the subscriber level or higher to delete or read arbitrary files on the server, thanks to insufficient input validation in the connector function. This is a classic missing authorization flaw, classified as CWE‑862, and can enable remote code execution if critical files such as wp-config.php are removed.

Bitpressadmin’s File Manager plugin for WordPress versions 6.0 through 6.9 are impacted. No operating system or PHP version restrictions are listed, meaning any WordPress site running any of these releases is potentially vulnerable.

The CVSS score is 8.8, reflecting high severity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Exploitation requires an attacker to be authenticated with at least subscriber access and then issue a POST request to the ajax handler with a query string containing cmd=rm or cmd=file; because the dispatcher reads from the merged superglobal array, the command runs unchecked against the server’s ABSPATH, allowing arbitrary deletion or reading of files.