What the vulnerability does
01Description
The File Manager Advanced Shortcode plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.4 (file-manager-advanced-shortcode) and 2.5.6 (advanced-file-manager-pro-premium), via the 'file_manager_advanced' shortcode. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary JavaScript files on the server. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Sites currently using 2.5.4 (file-manager-advanced-shortcode) should be updated to 2.6.0 (advanced-file-manager-pro-premium).
Explanation of Vulnerability in Simple Terms
02Summary
File Manager Advanced Shortcode versions up to 2.5.4 contain a path traversal vulnerability that allows high-privilege users to read, write, or delete files outside the intended directory. An attacker with administrator or equivalent access can navigate the file system using directory traversal sequences to access sensitive files. This affects confidentiality, integrity, and availability of site data.
What an attacker can do
03Attacker Capabilities
Read, write, or delete files anywhere on the server that the web server process can access.
Potential impact on your site
04Site Impact
A compromised admin account can be used to access or modify critical site files, database files, or other sensitive data on the server.
Conditions required to exploit
05Prerequisites
Attacker must have high-level privileges (administrator or equivalent role) on the WordPress site.
Key dates
06Disclosure timeline
May 15, 2025
CVE published
April 8, 2026
Record updated
