Is CVE-2026-17542 being exploited?

No public exploit is currently tracked.

Back

CVE-2026-17542

Description

The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, such as a subscriber, to browse the entire WordPress installation directory and download files of certain types from it, including archives and documents which may contain sensitive data.