WordPress plugin · wp-file-manager
Is File Manager safe?
Attackers are using a flaw in it.
One flaw in it is on CISA’s list of vulnerabilities being exploited right now. If you run it, update today (every recorded fix is in 8.0.5 or earlier).
- Flaws on record
- 15
- High or critical
- 9
- Exploited
- 1
- Current version
- 8.0.6
- Last updated
- Sep 24, 2026
- Active installs
- 1,000,000+
Every recorded flaw
- Sep 26, 2026File Manager: Does not prevent unauthenticated users from downloading its database backup archivesCVE-2026-19708 · fixed in 8.0.5 · reported by WPScanMedium 5.9
- Aug 10, 2026File Manager: Does not perform any capability check on one of its file manager connector endpointsCVE-2026-17542 · fixed in 6.9.1 · reported by WPScanHigh 7.5
- Aug 10, 2026File Manager: Does not have authorisation checks on one of its REST API routesCVE-2026-17541 · fixed in 6.9.1 · reported by WPScanHigh 7.5
- Aug 10, 2026File Manager: Does not properly authorise its file management commandsCVE-2026-17540 · fixed in 6.9.1 · reported by WPScan1.8% oddsHigh 8.8
- Nov 1, 2024File Manager: Missing AuthorizationCVE-2024-37254 · affects up to 7.2.7 · reported by PatchstackMedium 4.3
- Oct 16, 2024File Manager: Authorization bypassCVE-2018-25105 · affects up to 3.0 · reported by WordfenceCritical 9.8
- Apr 9, 2024File Manager: Directory TraversalCVE-2024-2654 · affects up to 7.2.5 · reported by WordfenceMedium 6.8
- Mar 21, 2024File Manager: Cross-Site Request ForgeryCVE-2024-1538 · affects up to 7.2.4 · reported by Wordfence11% oddsHigh 8.8
- Mar 13, 2024The File Manager and File Manager Pro plugins for WordPress are vulnerable to Directory Traversal in versions up to, and including version 7.2.1 (free version) CVE-2023-6825 · affects up to 7.2.1 · reported by Wordfence6.0% oddsCritical 9.9
- Feb 5, 2024File Manager: Sensitive Information ExposureCVE-2024-0761 · affects up to 7.2.1 · reported by Wordfence1.0% oddsHigh 8.1
- Dec 11, 2023File Manager: Does not restrict the file managers root directoryCVE-2023-5907 · fixed in 6.3 · reported by WPScanMedium 6.5
- Apr 5, 2021In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the endpoint /wp-admin/admin.php?page=wp_file_managerCVE-2021-24177 · fixed in 7.1 · reported by WPScanMedium 5.4
- Sep 9, 2020WordPress File Manager Plugin Remote Code Execution VulnerabilityCVE-2020-25213 · fixed in 6.9 · reported by MITREExploited97% oddsCritical 10
- Apr 15, 2019There is an XSS vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parameter.CVE-2018-16967 · affects 3.0 to 3.0 · reported by MITRE1.4% oddsMedium 6.1
- Apr 15, 2019There is a CSRF vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parameter.CVE-2018-16966 · affects 3.0 to 3.0 · reported by MITREHigh 8.8
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.