Security Alert Summary
Multiple WordPress plugins bundle a vulnerable file-manager library that does not correctly validate the origin of window messages used by the file browser on admin screens. This allows an unauthenticated attacker to run arbitrary JavaScript in the session of a logged-in administrator who visits a page under the attacker control.
CVE Details
- CVE ID: CVE-2026-85081
- Affected plugin or component: File Manager, FileOrganizer, File Manager Pro (issues in the bundled file-manager library)
- Affected versions: File Manager < 8.0.5; FileOrganizer < 1.2.1; File Manager Pro < 2.1.3. The bundled file-manager library in all three plugins is affected in versions < 2.1.70.
- Published: September 26, 2026 at 07:17:02 AM UTC
- Last modified: September 26, 2026 at 07:17:02 AM UTC
- CVSS v3.1: Not provided
- Authentication requirements: None (unauthenticated attacker)
- Privileges required: None
- User interaction: Yes – requires a logged-in administrator to visit a page under attacker control
- Impact: Confidentiality: possible exposure of administrator data and session information; Integrity: attacker-controlled JavaScript may modify content or settings in the admin session; Availability: not directly indicated by the description
- CWE / weakness ID: Not specified
Technical Details
The vulnerability arises from incorrect origin validation for window messages received by the file browser loaded on admin screens. The bundled file-manager library accepts any origin that is a leading string prefix of the site’s own address instead of requiring an exact origin match. In practical terms, messages sent via mechanisms such as window.postMessage can be accepted based on a prefix comparison rather than exact origin equality.
This weakness allows an unauthenticated attacker to craft a page that sends messages the file-manager library will accept. If a logged-in administrator visits the attacker-controlled page, the attacker can execute arbitrary JavaScript in the administrator’s session context. The defect is present in every bundled file-manager library version below 2.1.70; updating the bundled library to a fixed version addresses the issue.
How This Could Impact Your Website
Consider a small site where the owner manages account-level settings, internal staff editors publish content, and an external contractor contributes media. If a logged-in administrator follows a link or visits a page controlled by an attacker, the attacker could run scripts in that administrator’s session. This could expose internal administrator or user email addresses, leak session data, or result in unauthorized edits to content or settings. The exposed information can also increase the risk of targeted phishing or social engineering aimed at staff and contractors.
If you
re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugins as soon as a patched version that updates the bundled file-manager library is available.
- Review and reduce unnecessary user roles, with particular attention to contributor and editor permissions.
- Enforce strong passwords and enable two-factor authentication for editor and administrator accounts.
- Remove unused or unmaintained plugins and keep all plugins and bundled libraries up to date.
- Monitor site activity and admin sessions for unusual behavior such as unexpected content changes, new admin accounts, or suspicious login activity.
If you
like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
