The File Manager WordPress plugin fails to perform a capability check on its bitapps_fm_connector endpoint. As a result, any authenticated user, including a simple subscriber, can request this endpoint and receive a listing of all files in the WordPress installation directory. The endpoint additionally allows downloading of file types such as archives and documents, which may contain confidential information, configuration files, or user data. The vulnerability is a classic example of inadequate access control reflected in CWE-200 that leads to confidentiality loss without exploiting any system resources beyond the existing user privileges.

WordPress sites using the File Manager plugin before version 6.9.1. All installations where the plugin is present and the bitapps_fm_connector endpoint is not disabled or permission-restricted are affected.

An attacker must first authenticate to the WordPress site with any user role that has access to the plugin, but no administrative privileges are required. The EPSS score is < 1%, indicating a very low but nonzero probability of exploitation. The vulnerability is not in the KEV catalog, which suggests it may not yet be actively exploited in the wild. However, the impact of revealing sensitive files justifies a high risk assessment. The CVSS score of 7.5 indicates high severity, but the potential for data disclosure is significant, especially in multi‑tenant or multi‑user environments.