Unknown File Manager vulnerabilities

6 CVEs affecting Unknown File Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-85081, published 2026-09-26.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-6382, published 2026-07-06. Critical severity, CVSS 9.1. EPSS: 1.4% chance of exploitation in the next 30 days. The FileOrganizer WordPress plugin before 1.1.9, Advanced File Manager WordPress plugin before 5.4.12, File Manager Pro WordPress plugin before 2.1.1, File Manager WordPress plugin before 8.0.4 do…
CVE-2026-17541, published 2026-08-10. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file…
CVE-2026-17540, published 2026-08-10. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files…
CVE-2026-17542, published 2026-08-10. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, such as a subscriber, to browse…
CVE-2026-85081, published 2026-09-26. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages…
CVE-2026-19708, published 2026-09-26. Medium severity, CVSS 5.9. EPSS: 0.2% chance of exploitation in the next 30 days. The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in some cases writes them under a fixed filename, allowing…