Advanced File Manager < 5.1.1 - Admin+ Arbitrary File/Folder Access
Priority MEDIUM 56CWE-863Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-863.
Summary
The Advanced File Manager WordPress plugin before 5.1.1 does not adequately authorize its usage on multisite installations, allowing site admin users to list and read arbitrary files and folders on the server.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00616 49th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Advanced File Manager (Unknown): 5.1.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Advanced File Manager | before 5.1.1 | 5.1.1 | Patch available | CNA |
- Advanced File Manager VendorUnknown Affected before 5.1.1 Fixed in 5.1.1 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:advancedfilemanager:advanced_file_manager:*:*:*:*:*:wordpress:*:* | before 5.1.1 | Vulnerable | Advanced File Manager |
- cpe:2.3:a:advancedfilemanager:advanced_file_manager:*:*:*:*:*:wordpress:*:* Versions before 5.1.1 Vulnerable ·Advanced File Manager
Remediation
- Fix · CNA Advanced File Manager (Unknown) Fixed in 5.1.1
Timeline
- 2026-10-02 Threatist record created from CVE-2023-3814
- 2026-10-03 Alias added: GHSA-26r5-gf8m-4xfr
References
More Advanced File Manager vulnerabilities
- TI-2025-30185 WordPress Advanced File Manager plugin <= 5.3.1 - Broken Access Control to Notice Dismissal vulnerability CVSS 3.1CRITICAL 9.8
- TI-2024-07533 Advanced File Manager <= 5.2.8 - Authenticated (Subscriber+) Arbitrary File Upload CVSS 3.1HIGH 8.8
- TI-2024-05200 Advanced File Manager <= 5.2.4 - Sensitive Information Exposure via Directory Listing CVSS 3.1HIGH 7.5
- TI-2024-12376 Advanced File Manager 5.2.12 - 5.2.13 - Authenticated (Subscriber+) Arbitrary File Upload CVSS 3.1HIGH 7.5
- TI-2024-10555 Advanced File Manager <= 5.2.10 - Authenticated (Subscriber+) Arbitrary File Upload CVSS 3.1HIGH 7.5
- TI-2024-08073 Advanced File Manager <= 5.2.8 - Authenticated (Administrator+) Local JavaScript File Inclusion via fma_locale CVSS 3.1HIGH 7.2
Sources
- CVE-2023-3814 · CVE Program
- CVE-2023-3814 · NVD
- FIRST EPSS
- GHSA-26r5-gf8m-4xfr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences