The File Manager WordPress plugin prior to version 6.9.1 allows any authenticated user, including those with a subscriber role, to read and delete arbitrary files located anywhere under the WordPress installation directory. This improper authorization flaw can lead to the exposure of sensitive configuration data and the removal of critical files, potentially causing a denial‑of‑service condition for the site. The weakness aligns with Improper Authorization (CWE‑284).

WordPress sites using the File Manager plugin version 6.9.0 or earlier are affected. The vulnerability is present in all releases of the plugin before 6.9.1, regardless of WordPress version or theme used.

The risk is substantial because the attacker only needs to be an authenticated user, which is often the case for standard subscribers. The CVSS score of 8.8 indicates high severity. The EPSS score of <1% suggests exploitation probability is low, but the vulnerability is still not listed in CISA’s KEV catalog. The attack vector is inferred to be via normal authenticated access to the plugin’s endpoint, exploiting the request source mismatch that bypasses role checks.