What’s Vulnerable › Vulnerabilities

CVE-2023-3814: Advanced File Manager < 5.1.1 - Admin+ Arbitrary File/Folder Access

• Severity: medium (CVSS 4.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-09-04 · updated 2026-06-17
• Weakness: CWE-863

Description

The Advanced File Manager WordPress plugin before 5.1.1 does not adequately authorize its usage on multisite installations, allowing site admin users to list and read arbitrary files and folders on the server.

Affected products

• saadiqbal Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution: before 5.1.1 — fixed in 5.1.1

How to fix

Upgrade to a fixed version: saadiqbal Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution 5.1.1. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/ca954ec6-6ebd-4d72-a323-570474e2e339
• https://wpscan.com/vulnerability/ca954ec6-6ebd-4d72-a323-570474e2e339
• https://wpscan.com/vulnerability/ca954ec6-6ebd-4d72-a323-570474e2e339

Get alerted when CVE-2023-3814 or the next vulnerability affects your stack