File Manager

WordPress plugin · wp-file-manager · WordPress.org ↗

Latest v8.0.4 Last release Apr 21, 2026 Tested up to WP 6.9.7 1,000,000+ active installs

Critical

High

Known total

Unfixed

Running File Manager on your site? WP Alerts checks your installed version against every entry below and emails you only when one affects you. Free, no tracking.

Scan a site Monitor my sites →

Severity	Vulnerability	Affected	Fixed in	CVE	Published
CRITICAL CVSS 9.9	File Manager [wp-file-manager] < 7.2.2 WPVulnerability	< 7.2.2	v7.2.2	CVE-2023-6825	Mar 4, 2024
CRITICAL CVSS 9.8	File Manager [wp-file-manager] < 6.9 WPVulnerability · actively exploited · PoC available	< 6.9	v6.9	CVE-2020-25213	Sep 1, 2020
CRITICAL CVSS 9.8	File Manager [wp-file-manager] < 3.1 WPVulnerability	< 3.1	v3.1	CVE-2018-25105	Sep 17, 2018
HIGH CVSS 8.8	File Manager [wp-file-manager] < 7.2.5 WPVulnerability	< 7.2.5	v7.2.5	CVE-2024-1538	Mar 20, 2024
HIGH CVSS 7.5	File Manager [wp-file-manager] < 7.2.2 WPVulnerability	< 7.2.2	v7.2.2	CVE-2024-0761	Jan 22, 2024
HIGH CVSS 7.5	File Manager [wp-file-manager] < 6.5 WPVulnerability	< 6.5	v6.5	CVE-2020-24312	Aug 13, 2020
HIGH CVSS 8.8	File Manager [wp-file-manager] < 3.1 WPVulnerability	< 3.1	v3.1	CVE-2018-16966	Sep 17, 2018
MEDIUM CVSS 4.3	File Manager [wp-file-manager] < 7.2.8 WPVulnerability	< 7.2.8	v7.2.8	CVE-2024-37254	Jun 27, 2024
MEDIUM CVSS 6.8	File Manager [wp-file-manager] < 7.2.6 WPVulnerability	< 7.2.6	v7.2.6	CVE-2024-2654	Apr 3, 2024
MEDIUM CVSS 5.4	File Manager [wp-file-manager] < 7.1 WPVulnerability	< 7.1	v7.1	CVE-2021-24177	Feb 26, 2021
MEDIUM CVSS 6.1	File Manager [wp-file-manager] < 3.1 WPVulnerability	< 3.1	v3.1	CVE-2018-16967	Sep 17, 2018
MEDIUM CVSS 5.4	File Manager [wp-file-manager] < 3.0 WPVulnerability	< 3.0	v3.0	CVE-2018-16363	Sep 6, 2018
UNKNOWN	File Manager [wp-file-manager] < 8.0.4 WPVulnerability	< 8.0.4	v8.0.4	CVE-2026-6382	Jun 15, 2026
UNKNOWN	File Manager [wp-file-manager] < 4.9 WPVulnerability	< 4.9	v4.9	—	Aug 7, 2019
UNKNOWN	File Manager [wp-file-manager] < 5.2 WPVulnerability	< 5.2	v5.2	—	—

Data aggregated from WPVulnerability, NVD/NIST, ENISA EUVD, CVE.org and WordPress.org. Provided as-is; verify with the plugin author before acting. Disclaimer.