{"id":"CVE-2023-3814","aliases":["EUVD-2023-44447","GHSA-26r5-gf8m-4xfr"],"status":"published","title":"Advanced File Manager \u003c 5.1.1 - Admin+ Arbitrary File/Folder Access","description":"The Advanced File Manager WordPress plugin before 5.1.1 does not adequately authorize its usage on multisite installations, allowing site admin users to list and read arbitrary files and folders on the server.","severity":{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00616,"percentile":0.49878,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284","CWE-863"],"published":"2023-09-04T11:27:01Z","modified":"2026-06-17T06:14:54Z","products":[{"vendor":"advancedfilemanager","product":"advanced_file_manager"},{"vendor":"saad iqbal","product":"advanced file manager"},{"vendor":"unknown","product":"advanced file manager"}],"references":[{"url":"https://wpscan.com/vulnerability/ca954ec6-6ebd-4d72-a323-570474e2e339","tags":["exploit","vdb-entry","technical-description","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3814"},{"url":"https://github.com/advisories/GHSA-26r5-gf8m-4xfr"}],"sources":{"cve":[{"id":"CVE-2023-3814","title":"Advanced File Manager \u003c 5.1.1 - Admin+ Arbitrary File/Folder Access","description":"The Advanced File Manager WordPress plugin before 5.1.1 does not adequately authorize its usage on multisite installations, allowing site admin users to list and read arbitrary files and folders on the server.","status":"published","published":"2023-09-04T11:27:01.778Z","modified":"2025-03-06T16:03:22.116Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:35:24.360381Z"}],"euvd":[{"id":"EUVD-2023-44447","description":"The Advanced File Manager WordPress plugin before 5.1.1 does not adequately authorize its usage on multisite installations, allowing site admin users to list and read arbitrary files and folders on the server.","status":"published","published":"2023-09-04T11:27:01Z","modified":"2025-03-06T16:03:22Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:53:11.47787Z"}],"ghsa":[{"id":"GHSA-26r5-gf8m-4xfr","title":"The Advanced File Manager WordPress plugin before 5.1.1 does not adequately authorize its usage...","description":"The Advanced File Manager WordPress plugin before 5.1.1 does not adequately authorize its usage on multisite installations, allowing site admin users to list and read arbitrary files and folders on the server.","status":"published","published":"2023-09-04T12:30:19Z","modified":"2024-04-04T07:25:55Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-284","CWE-863"],"updated_at":"2026-11-02T14:56:51.525022Z"}],"nvd":[{"id":"CVE-2023-3814","description":"The Advanced File Manager WordPress plugin before 5.1.1 does not adequately authorize its usage on multisite installations, allowing site admin users to list and read arbitrary files and folders on the server.","status":"published","published":"2023-09-04T12:15:09.57Z","modified":"2026-06-17T06:14:54.987Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:08:27.181588Z"}]}}