CVE-2026-15991

Executive Summary

CVE-2026-15991 is a critical missing authorization vulnerability in the WordPress File Manager plugin (versions 6.0 through 6.9). The flaw enables authenticated attackers with subscriber-level access to read and delete arbitrary files on the server by exploiting an inconsistency between how the elFinder connector registers permission handlers (reading exclusively from $_POST) versus how the dispatcher executes commands (reading from merged $_GET + $_POST superglobals). Successful exploitation can lead to complete site compromise and remote code execution, particularly if the attacker deletes wp-config.php. The vulnerability carries a CVSS score of 8.8, indicating high severity due to the high impact on confidentiality, integrity, and availability with low attack complexity.

Technical Analysis

Vulnerability Mechanism

The File Manager plugin integrates elFinder, a popular web-based file management library. The vulnerability stems from a fundamental inconsistency in how the plugin's connector handles command parameters across different stages of request processing:

1. Permission Registration Phase: During connector initialization, elFinder registers command-specific permission handlers. Critically, the bind registration logic reads the cmd parameter exclusively from $_POST. If the cmd parameter is not present in the POST data, the rm.pre permission handler is never registered.

2. Command Dispatch Phase: The dispatcher, responsible for executing commands, reads command parameters from the merged $_GET + $_POST superglobals. This means parameters passed via the query string (GET) are seamlessly merged with POST data during execution.

3. The Bypass: By passing cmd=rm or cmd=file in the URL query string of a POST request, an attacker achieves the following:

   • The bind registration checks $_POST and finds no cmd parameter, so it skips registration of the rm.pre permission handler
   • The dispatcher sees the cmd parameter from the merged superglobals and executes the rm (delete) or file (read) command
   • Because the permission handler was never registered, the command executes without authorization checks
   • The target volume defaults to ABSPATH (the WordPress root directory), giving attackers access to the entire site's file system

Insufficient Path Validation

In addition to the authorization bypass, the vulnerability includes insufficient file path validation. This means an attacker is not limited to the designated "File Manager" root directory but can traverse to any location accessible by the web server user, including:

• WordPress configuration files (wp-config.php)
• PHP files containing credentials or business logic
• Other web applications hosted on the same server
• Local filesystem paths outside the web root (if permissions allow)

Attack Surface

• Authentication: Subscriber-level (lowest privilege) WordPress account or higher
• Transport: HTTP POST request with crafted query string parameters
• Entry Point: Any page exposing the File Manager connector endpoint (typically admin-ajax.php or a custom connector URL)
• Preconditions: WordPress instance with File Manager 6.0–6.9 installed and active

Exploitation Scenarios

Scenario 1: Full Site Takeover via wp-config.php Deletion

1. Reconnaissance: The attacker harvests valid WordPress subscriber credentials via password spraying, phishing, or credential stuffing. Alternatively, they register a new subscriber account if open registration is enabled. The attacker fingerprints the target using fingerprinting tools to identify the File Manager plugin version (e.g., checking /wp-content/plugins/file-manager/readme.txt).

2. Trigger/Weaponization: The attacker crafts a POST request to the elFinder connector endpoint:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target.com
   Cookie: [subscriber session cookie]
   
   action=connector&cmd=rm&targets[]=l1_ABSPATH_wp-config.php
   

   Critically, the cmd=rm parameter is delivered in the URL query string (even though the request is POST), while the POST body contains only the action and targets parameters. This exploits the $_POST vs. merged $_GET+$_POST inconsistency.

3. Payload/Execution: The connector dispatcher reads cmd=rm from the merged superglobals and executes the delete command against the targeted file. Using path traversal techniques in the targets parameter with proper elFinder hash encoding (or direct path references where supported), the attacker targets wp-config.php in ABSPATH.

4. Post-Exploitation: With wp-config.php deleted, WordPress can no longer establish database connections. The attacker then either:

   • Reinstalls WordPress (which triggers a fresh installation wizard), allowing them to set a new database prefix and potentially inject malicious configuration
   • Leverages PHP error messages that may leak file paths and facilitate further exploitation
   • Combines file read capability (cmd=file) to exfiltrate sensitive data from the configuration file before deletion

Scenario 2: Credential Exfiltration and Lateral Movement

1. Reconnaissance: Attacker identifies File Manager instance and confirms subscriber access.

2. Trigger/Weaponization: The attacker uses the arbitrary file read capability:

   POST /wp-admin/admin-ajax.php?action=connector&cmd=file&target=l1_ABSPATH_wp-config.php HTTP/1.1
   

   The cmd=file is in the query string; the POST body contains minimal parameters.

3. Payload/Execution: The connector reads wp-config.php and returns its contents including database credentials, authentication keys, and salts.

4. Post-Exploitation: With database credentials, the attacker connects directly to MySQL, creates a new admin user, installs a webshell, and achieves persistent access. Database credentials may also be reused across other infrastructure components.

Impact Assessment

CVSS Score Rationale (8.8 — High):

• Attack Vector: Network (AV:N) — Exploitable remotely over the internet
• Attack Complexity: Low (AC:L) — No special conditions required beyond authentication
• Privileges Required: Low (PR:L) — Subscriber-level account sufficient
• User Interaction: None (UI:N) — No victim interaction needed
• Confidentiality Impact: High (C:H) — Arbitrary file read exposes database credentials, source code, and sensitive configuration
• Integrity Impact: High (I:H) — Arbitrary file deletion can destroy critical site files
• Availability Impact: High (A:H) — Site outage if critical files are deleted

Business Impact:

• Complete compromise of WordPress instance and associated data
• Exposure of database credentials enabling lateral movement to backend infrastructure
• Ransom/extortion potential via site defacement or data destruction
• Compliance violations if customer data is exposed through file reads
• Supply chain risk if the compromised server hosts multiple applications

Blast Radius: Any server running File Manager 6.0–6.9. The default volume path (ABSPATH) means all WordPress files are accessible. If the web server user has broader filesystem permissions, the compromise extends to co-hosted applications.

Detection Guidance

Sigma Rule

title: File Manager WordPress Plugin - Arbitrary File Read/Delete Attempt
id: 9b7a2f4e-8c3d-4a1b-b6e5-2f0d9c8a7b6a
status: experimental
description: Detects exploitation attempts targeting CVE-2026-15991 via cmd parameter in query string of POST requests to elFinder connector
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-15991
tags:
    - attack.tactic.execution
    - attack.technique.t1006
    - cve.2026.15991
logsource:
    category: webserver
    product: apache
    definition: Web server access logs for WordPress environments
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains|all:
            - 'cmd=rm'
            - 'cmd=file'
        cs-uri-query|contains:
            - 'action=connector'
            - 'file-manager'
            - 'elfinder'
    filter_wp_admin:
        cs-uri-stem|contains: '/wp-admin/'
    condition: selection and filter_wp_admin
falsepositives:
    - Legitimate file manager operations (if authorization verification is functioning)
    - Plugin updates or maintenance operations
level: high

YARA Rule

rule CVE_2026_15991_FileManager_Exploit {
    meta:
        description = "Detects HTTP requests exploiting File Manager WordPress plugin arbitrary file read/delete"
        author = "Valters IT Security Research"
        date = "2026-01-15"
        reference = "CVE-2026-15991"
        severity = "critical"
        tags = "cve-2026-15991|file-manager|wordpress|arbitrary-file-delete"
    strings:
        $cmd_rm = "cmd=rm"
        $cmd_file = "cmd=file"
        $connector = "action=connector"
        $elfinder = "elfinder"
        $wp_config = "wp-config.php"
        $targets = "targets[]="
        $abspath = "ABSPATH"
    condition:
        uint16(0) == 0x0A0D and
        filesize < 10KB and
        any of ($cmd_rm, $cmd_file) and
        any of ($connector, $elfinder) and
        any of ($wp_config, $targets, $abspath)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2026-15991 - File Manager WordPress Plugin Arbitrary File Read/Delete Attempt";
    flow:to_server,established;
    http.method;
    content:"POST";
    http.uri;
    content:"cmd=rm";
    nocase;
    http.uri;
    content:"cmd=file";
    nocase;
    http.uri;
    content:"action=connector";
    nocase;
    http.uri;
    content:"elfinder";
    nocase;
    sid:202615991;
    rev:1;
    classtype:attempted-admin;
    reference:cve,2026-15991;
    metadata:attack_target Web_Server, deployment Perimeter, signature_severity Critical, created_at 2026_01_15;
)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where destination.port == 80 or destination.port == 443
   and http.request.method == "POST"
   and http.request.uri contains "action=connector"]
  [network where destination.port == 80 or destination.port == 443
   and http.request.uri contains ("cmd=rm", "cmd=file")
   and http.request.uri contains ("elfinder", "file-manager")]

Splunk SPL Query

index=web sourcetype=access_combined
| search method=POST 
| search uri_path="*/wp-admin/admin-ajax.php*" OR uri_path="*/elfinder*" OR uri_path="*/file-manager*"
| search uri_query="*cmd=rm*" OR uri_query="*cmd=file*"
| eval vulnerability="CVE-2026-15991", severity="critical"
| table _time, src_ip, dest_host, uri_path, uri_query, http_user_agent, vulnerability
| sort -_time

Wazuh OSSEC Rule

<group name="wordpress,cve-2026-15991,">
  <rule id="100591" level="12">
    <if_sid>31151</if_sid>
    <regex>POST.*(cmd=rm|cmd=file)</regex>
    <regex>POST.*(action=connector|elfinder|file-manager)</regex>
    <description>CVE-2026-15991: File Manager WordPress plugin arbitrary file read/delete exploitation attempt detected</description>
    <group>attack,exploitation,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED No patch evidence exists from any tracked source. The vendor has not released a fixed version, and no vendor advisory was published at the time of this report. This vulnerability affects all File Manager versions 6.0 through 6.9.

1) Immediate Mitigations (Do These Now)

• Disable the plugin: If the File Manager plugin is not business-critical, deactivate and delete it immediately.
• Restrict access: If deactivation is not possible, implement a WAF (Web Application Firewall) rule to block requests containing cmd=rm or cmd=file in the query string where the request method is POST and the URI references the connector endpoint.
• Harden subscriber roles: If your WordPress site allows public registration, disable it or restrict subscriber-level users from accessing admin-ajax endpoints.
• Block connector endpoint: Use an .htaccess rule or server-level configuration to deny access to the elFinder connector URL unless originating from administrative IP addresses.

2) Patch/Upgrade Steps

• Monitor for vendor updates: Check the WordPress plugin repository daily for File Manager updates. This vulnerability will require a vendor patch that corrects the command parameter handling to consistently read from merged superglobals during permission registration.
• Watch the NVD entry: The CVE record will be updated with patch information once available.
• Subscribe to security advisories: Register with WordPress security mailing lists and the plugin author's notification system.

3) Long-Term Hardening

• Least privilege principle: Run WordPress under a dedicated system user with minimal filesystem permissions. This limits the blast radius of arbitrary file read/delete vulnerabilities.
• File integrity monitoring: Implement a file integrity monitoring solution (e.g., Tripwire, OSSEC, or Wazuh FIM) to detect unauthorized file modifications or deletions.
• Restrict wp-config.php access: Enforce filesystem permissions of 600 on wp-config.php and restrict web server access to this file.
• Database credential rotation: If you suspect compromise, rotate all database credentials and WordPress authentication keys immediately.
• Web application firewall: Deploy a WAF with OWASP Core Rule Set or WordPress-specific rules to filter malicious query strings.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-15991
2. Wordfence Advisory (expected): https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/file-manager
3. WordPress Plugin Repository: https://wordpress.org/plugins/file-manager/
4. MITRE ATT&CK Technique Mapping: https://attack.mitre.org/techniques/T1006/
5. elFinder Documentation (elFinder connector architecture): https://studio-42.github.io/elFinder/

Threat Actor Campaigns: At the time of this report, no known in-the-wild exploitation campaigns were confirmed. CISA has not added this CVE to the Known Exploited Vulnerabilities (KEV) catalog. However, the EPSS score of 0.00606 (45.7th percentile) suggests moderate exploitation likelihood in the near term, and the vulnerability class (subscriber-plus file system access) is a favored target for automated WordPress attack bots. Security teams should monitor WordPress admin access logs for anomalous POST requests to connector endpoints and treat any unauthorized subscriber account creation as a potential precursor to exploitation.