CVE-2023-6825 is a critical (CVSS 9.9) directory traversal flaw in the File Manager and File Manager Pro plugins for WordPress, up to 7.2.1 (free) and 8.3.4 (Pro). It allows reading arbitrary server files and uploading to other directories. Update to a newer release.
What's affected
The record lists versions up to and including 7.2.1 of the free plugin and 8.3.4 of the Pro plugin. The free version needs Administrator access to be exploited. The Pro version can embed a file manager through a shortcode and lets admins grant file handling privileges to other user levels, so lower-level users could reach the flaw on sites that use those features.
The referenced Wordfence and WordPress.org changeset pages did not load for automated reading, so the exact fixed numbers are not restated. Any release above 7.2.1 for the free plugin and above 8.3.4 for Pro is the starting point.
How to check if you're exposed
Run these from your WordPress root with WP-CLI. They only read.
wp plugin list --fields=name,status,version,update
wp plugin get wp-file-manager --field=version
The free plugin is affected up to 7.2.1; the Pro plugin is affected up to 8.3.4. File Manager Pro is a separate download, so check it by name on the Plugins screen. If WP-CLI is not available, open Plugins in the dashboard and read the version under the plugin name. Also check staging copies, old backups restored to test sites, and multisite networks, where the plugin may be installed on only some sites.
Also confirm the plugin is still needed. A file manager in the dashboard is a high-privilege tool.
What to do now
- Update the plugin:
wp plugin update wp-file-manager, or use the Plugins screen. Update File Manager Pro from the vendor as well. - If no fixed release is available, deactivate and delete the plugin and use a maintained alternative.
- Review the site's user list and recent changes for anything you do not recognize, and rotate credentials the plugin handled.
- Keep automatic updates on for plugins that handle sensitive data, and remove plugins you no longer use.
- Review upload directories and the web root for files you did not place there, and review which roles were granted file handling privileges.
Why it matters
The description says the weakness is in the target parameter of the mk_file_folder_manager_action_callback_shortcode function. The code accepts a path and does not keep it inside the intended directory, which allows reading files from elsewhere on the server and uploading into other folders. The record tags CWE-23 and CWE-22. Server files such as configuration can hold database passwords and keys.
Path traversal happens when a program builds a file path from input and does not confirm the result stays inside the folder it meant to use. The fix is to normalize the path, compare it against an allowed base directory, and reject anything that leaves it.
Patch priority depends on who can reach the flaw. Issues open to anonymous visitors come first, then issues that need a low-privilege account, then issues that need an administrator. Use the access level in the description to place this item in your queue, and write down the date you updated so you can answer later when someone asks whether a given site was exposed.
Weakness class in the record: CWE-22 (Path Traversal) CWE-23 (Relative Path Traversal).
Quick check
Is a file manager plugin worth the risk?
It is a high-privilege tool by design. If you can do the same job with SFTP or your host's file manager, removing the plugin removes the risk entirely.
How do I find every site that runs this plugin?
Check your hosting dashboards and any site management tool, and run the WP-CLI commands above on each install. Agencies and hosts often forget staging copies and sites inherited from clients.
Sources
Last reviewed: 19 October 2026.
