The File Manager WordPress plugin exposes a REST API route that lacks proper authorization checks, allowing any unauthenticated user to query the file activity log. This log contains details of file operations performed on the site, including the exact file paths and the usernames of the operators. The result is a disclosure of potentially sensitive operational information that could aid attackers in mapping the site’s structure and planning further exploits.

All installations of the File Manager plugin for WordPress running versions earlier than 6.9.1 are affected. The vulnerability is specifically tied to the absence of authentication on a REST API endpoint within the plugin, regardless of the broader WordPress configuration or other plugins present.

The exploit requires only unauthenticated access to the REST API endpoint; no special privileges or credentials are necessary. Because the endpoint is publicly reachable, the risk of exploitation is high if a malicious actor discovers it. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, confirming that it is unlikely to have been actively exploited. CVSS score of 7.5 indicates high severity, and the exposed data can aid attackers in mapping site structure and planning further exploits.