WordPress plugin
File Manager security & vulnerabilities
No known unpatched vulnerabilities in 8.0.7
All 16 known vulnerabilities are fixed in the latest release. If you run an older version, update to 8.0.7 or newer.
- Critical3
- High5
- Medium8
- Low0
All File Manager vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium5.3 | 8.0.4 - Unauthenticated Information Exposure 7.2.2 – 8.0.4Update to 8.0.5 | CVE-2026-19708 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤8.0.4Update to 8.0.5 | CVE-2026-85081 | |
| High7.2 | Authenticated Remote Code Execution <8.0.4Update to 8.0.4 | CVE-2026-6382 | |
| Medium4.3 | Missing Authorization ≤7.2.7Update to 7.2.8 | CVE-2024-37254 | |
| Medium6.8 | Authenticated (Administrator+) Directory Traversal ≤7.2.5Update to 7.2.6 | CVE-2024-2654 | |
| High8.8 | Cross-Site Request Forgery to Local JS File Inclusion ≤7.2.4Update to 7.2.5 | CVE-2024-1538 | |
| Critical9.9 | Directory Traversal ≤7.2.1Update to 7.2.2 | CVE-2023-6825 | |
| High8.1 | Sensitive Information Exposure via Backup Filenames ≤7.2.1Update to 7.2.2 | CVE-2024-0761 | |
| Medium5.4 | Reflected Cross-Site Scripting <7.1Update to 7.1 | CVE-2021-24177 | |
| Critical9.8 | Arbitrary File Upload/Remote Code Execution ≤6.8Update to 6.9CISA KEVPublic PoC | CVE-2020-25213 | |
| High7.5 | Unauthenticated Resource Access to Site Backups ≤6.4Update to 6.5 | CVE-2020-24312 | |
| Medium6.3 | Missing Authorization on AJAX Actions ≤4.8Update to 4.9 | — | |
| Critical9.8 | Unauthenticated Arbitrary File Upload/Download ≤3.0Update to 3.1 | CVE-2018-25105 | |
| High8.8 | Cross-Site Request Forgery ≤3.0Update to 3.1 | CVE-2018-16966 | |
| Medium6.1 | Stored Cross-Site Scripting ≤3.0Update to 3.1 | CVE-2018-16967 | |
| Medium6.1 | Reflected Cross-Site Scripting <3.0Update to 3.0 | CVE-2018-16363 |
- Medium5.38.0.4 - Unauthenticated Information Exposure
7.2.2 – 8.0.4Update to 8.0.5
- Medium6.1Reflected Cross-Site Scripting
≤8.0.4Update to 8.0.5
- High7.2Authenticated Remote Code Execution
<8.0.4Update to 8.0.4
- Medium4.3Missing Authorization
≤7.2.7Update to 7.2.8
- Medium6.8Authenticated (Administrator+) Directory Traversal
≤7.2.5Update to 7.2.6
- High8.8Cross-Site Request Forgery to Local JS File Inclusion
≤7.2.4Update to 7.2.5
- Critical9.9Directory Traversal
≤7.2.1Update to 7.2.2
- High8.1Sensitive Information Exposure via Backup Filenames
≤7.2.1Update to 7.2.2
- Medium5.4Reflected Cross-Site Scripting
<7.1Update to 7.1
- Critical9.8KEVPoCArbitrary File Upload/Remote Code Execution
≤6.8Update to 6.9
- High7.5Unauthenticated Resource Access to Site Backups
≤6.4Update to 6.5
- Medium6.3Missing Authorization on AJAX Actions
≤4.8Update to 4.9
- Critical9.8Unauthenticated Arbitrary File Upload/Download
≤3.0Update to 3.1
- High8.8Cross-Site Request Forgery
≤3.0Update to 3.1
- Medium6.1Stored Cross-Site Scripting
≤3.0Update to 3.1
- Medium6.1Reflected Cross-Site Scripting
<3.0Update to 3.0
File Manager: common questions
Does File Manager have known vulnerabilities?
Yes. VulnCrest Radar lists 16 known vulnerabilities in File Manager: 3 critical, 5 high, 8 medium. None are known to affect version 8.0.7.
How do I check which version of File Manager I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent File Manager vulnerability?
CVE-2026-19708, published Sep 24, 2026: File Manager 7.2.2 - 8.0.4 - Unauthenticated Information Exposure. Severity: Medium (CVSS 5.3).
Is any File Manager vulnerability listed in CISA KEV?
Yes, 1 is listed in the CISA Known Exploited Vulnerabilities catalog. Patch immediately and review the site for signs of compromise.