A file manager plugin is one of the most common things running on a WordPress site. CVE-2026-6382 turns that convenience into remote code execution across four of them at once. The flaw is not in the plugins. It is in elFinder, the file manager library they all bundle: File Manager, Advanced File Manager, File Manager Pro, and FileOrganizer. File Manager alone runs on over a million active installs. It is authenticated OS command injection. A user with file manager access can pass unescaped input into an image operation and run shell commands as the web server. CVSS 9.1. One condition decides exposure. The flaw only triggers when image processing falls back to the ImageMagick convert CLI, which happens when neither the PHP imagick nor GD extension is present. If either is enabled, the vulnerable path is never used. Patched versions: - File Manager 8.0.4 - Advanced File Manager 5.4.12 - File Manager Pro 2.1.1 - FileOrganizer 1.1.9 No confirmed exploitation in the wild. A public PoC exists. WPScan coordinated disclosure under a single CVE. Full Advisory: https://app.transilience.cloud/run-history/62b335c6-0e5f-403b-b366-7a137b75240d?tab=preview&file=reports%2Fproducts%2FWordPress_File_Manager_Plugins__CVE-2026-6382__wordpress_file_manager_plugins__cve-2026-6382__report.pdf
Post summary
The post announces the discovery of a high‑severity RCE flaw in WordPress file manager plugins, cites a public PoC, lists patched releases, and confirms no known wild exploitation.