Loading story…
A high-severity vulnerability tracked as CVE-2026-15991 affects the Bitpressadmin File Manager plugin for WordPress in versions 6.0 through 6.9, allowing authenticated users with subscriber-level access or higher to read and delete arbitrary files on the server. The bug is a missing authorization issue caused by inconsistent handling of command parameters: elFinder registers permissions based on $_POST, while the plugin dispatcher executes commands from merged $_GET and $_POST input, letting attackers bypass checks by placing commands such as rm or file in the query string.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
The vulnerability later assigned CVE-2026-15991 was received by security@wordfence.com. The issue affects the WordPress File Manager plugin and enables authenticated subscriber-level users or higher to read and delete arbitrary files.
CVE-2026-15991 was published as a high-severity missing authorization flaw affecting File Manager versions 6.0 through 6.9. The disclosure credited researcher daroo and noted the issue was published through Wordfence's vulnerability disclosure program.
The vulnerability was fixed in File Manager version 6.9.1. The patch addressed the authorization bypass that allowed authenticated attackers to abuse rm and file commands to read or delete arbitrary files.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
threataft.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An **incorrect authorization** vulnerability tracked as `CVE-2025-3861` was disclosed in the **Prevent Direct Access – Protect WordPress Files** plugin for WordPress. The flaw stems from a misconfigured capability check in the `pda_lite_custom_permission_check` function, allowing authenticated users with **Contributor-level access or higher** to reach protected REST API endpoints that should have been more tightly restricted. Successful exploitation lets those lower-privileged users change the protection status of media files, weakening access controls intended to protect WordPress content. The issue affects versions **2.8.6 through 2.8.8.2**, is classified as **`CWE-863` (Incorrect Authorization)**, carries a **CVSS 3.1 score of 5.4**, and was fixed in version **2.8.8.3**.
Aug 9, 2026
Two high-severity vulnerabilities were disclosed in widely used WordPress form plugins, exposing sites to unauthenticated attacks that can lead to full server compromise. **CVE-2026-4347** affects **MW WP Form** through version `5.1.0` and stems from insufficient file path validation in `generate_user_filepath` and `move_temp_file_to_upload_dir`. An attacker can move arbitrary files on the server without authentication, and if a sensitive file such as `wp-config.php` is relocated, the flaw can be leveraged for remote code execution. Exploitation requires a form with a file upload field and the **Saving inquiry data in database** option enabled; the issue is tracked as **CWE-22**.
Jun 29, 2026
Multiple WordPress plugins were found vulnerable to **unauthenticated arbitrary file upload** flaws that can lead to remote code execution and full site compromise. The most urgent case involves the **Breeze Cache** plugin, where **CVE-2026-3844** affects versions through `2.4.4` when the optional **"Host Files Locally - Gravatars"** feature is enabled. Researchers said the bug stems from missing file-type validation in the `fetch_gravatar_from_remote` function, and BleepingComputer reported that attackers are already exploiting the issue in the wild, with Wordfence observing more than 170 attack attempts. Cloudways released a fix in version `2.4.5`, and defenders were urged to update immediately or disable the Gravatar-related feature until patching is complete. Two additional **Contact Form 7** upload extensions were also disclosed with critical upload weaknesses. **CVE-2026-5718** affects **Drag and Drop Multiple File Upload for Contact Form 7** through `1.3.9.6`, where custom blacklist handling can override the default dangerous-extension denylist and a non-ASCII filename trick can bypass sanitization, allowing attackers to upload PHP files. **CVE-2026-5364** affects **Drag and Drop File Upload for Contact Form 7** through `1.1.3`, where the plugin validates an unsanitized extension but saves a sanitized one, enabling bypasses using special characters such as `$`; researchers noted that `.htaccess` protections and filename randomization may reduce real-world exploitability. Together, the disclosures highlight a broader pattern of insecure file validation in WordPress upload plugins.
Jun 29, 2026