CVE-2026-11565

Name of the Vulnerable Software and Affected Versions Advanced File Manager versions prior to 5.4.13

Description Insufficient capability checks in several file management AJAX actions allow users with file-manager access, including those with the Subscriber role, to read arbitrary files on the server. This includes sensitive configuration files and the ability to overwrite existing non-PHP files, which could lead to the compromise of administrator accounts and the entire site.

Recommendations Update Advanced File Manager to version 5.4.13 or later.