Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access (as low as Subscriber) to read arbitrary files on the server — including sensitive configuration files — and to overwrite existing non-PHP files, which can be leveraged to compromise administrator accounts and the whole site.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🚨 CVE-2026-11565 - high 🚨 WordPress Advanced File Manager < 5.4.13 - Arbitrary File Read > The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability ... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-11565 @pdnuclei #NucleiTemplates #cve