Arbitrary File Deletion Vulnerability in WordPress File Manager Plugin

The File Manager plugin for WordPress (versions 6.0 through 6.9) is vulnerable to an arbitrary file deletion flaw caused by insufficient path validation within its connector function. The vulnerability arises from a discrepancy between how the elFinder library processes request parameters for permission handlers versus command dispatching. Authenticated users with subscriber-level access can manipulate the request by utilizing a POST request with specific cmd or cmf parameters. Because the library's bind registration ignores these commands while the dispatcher processes them using the merged $_GET and $_POST superglobals, an attacker can bypass security controls to target files relative to the WordPress ABSPATH. The ability to delete critical files such as wp-config.php can facilitate a subsequent remote code execution (RCE) attack, making this a high-impact vulnerability for WordPress environments.

Impact

Successful exploitation allows an authenticated attacker to delete arbitrary files on the underlying web server, potentially compromising the integrity and availability of the WordPress site. By deleting key configuration files like wp-config.php, an attacker can trigger a re-installation process or intercept database credentials, leading to full server compromise and RCE. This vulnerability affects any WordPress instance running the File Manager plugin between versions 6.0 and 6.9.

Recommendation

• Update the File Manager plugin for WordPress to the latest available version immediately to remediate the path validation logic.
• Monitor web access logs for POST requests to the file manager connector endpoint containing suspicious query parameters such as cmd=rm or cmf=file.
• Audit user roles within WordPress to ensure unauthorized users do not possess subscriber-level access or higher if not strictly required for site operation.