CVE-2026-17542

The File Manager WordPress plugin (vulnerable before 6.9.1) has a missing capability check on a file manager connector endpoint, enabling any authenticated user (e.g., a subscriber) to browse the WordPress installation directory and download certain file types (archives, documents) containing sen...