CVE-2025-47688 is a medium severity missing authorization flaw (CVSS 5.3) in the Advanced File Manager plugin for WordPress, versions through 5.3.1. Patchstack ties the issue to dismissing a notice. It lists 5.3.2 as the patched version, so update to 5.3.2 or later.
What's affected
The record says Advanced File Manager by Saad Iqbal, slug file-manager-advanced, is affected through 5.3.1. Patchstack lists 5.3.2 as the patched version.
The vector shows no privileges needed and only a low integrity impact. Patchstack's title describes broken access control to notice dismissal, and its priority is low, which matches that limited effect.
The record does not mark CVE-2025-47688 as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
On the server, WP-CLI shows the installed version and whether the plugin is active:
wp plugin list --name=file-manager-advanced --fields=name,version,status,update
If WP-CLI is not available, open Plugins in the WordPress admin and read the version under the plugin name. Compare it with the affected range above. A deactivated plugin is lower risk than an active one, but it still sits on disk, so remove it if you do not use it.
File manager plugins deserve extra care even when one flaw is minor. They can read and write files on your server, so check every setting that controls which roles may use them.
What to do now
- Update Advanced File Manager to 5.3.2 or later. With WP-CLI that is
wp plugin update file-manager-advanced. - Take a backup first if the site is busy, and test the update on a staging copy when you can.
- If you do not use the plugin, deactivate and delete it.
- Review which user roles can open the file manager in the plugin settings, and restrict it to administrators only.
- Review your plugin list for anything else that is out of date. Old plugins are where most WordPress incidents begin.
- Turn on automatic updates for plugins you trust, or add a regular review to your calendar.
If you want a quick look at what your own projects pull in, the free in-browser dependency scan at https://gold.safeguard.sh/scan needs no setup. The Gold directory lets you look up other CVEs by id.
Why it matters
The record classifies this as CWE-862, missing authorization. An action that should be limited to certain users can be triggered by someone who has no right to it. In this case Patchstack's entry points to dismissing an admin notice, so the direct impact is small.
It still matters as a signal. A plugin that skips one permission check may skip others, and a file manager is a powerful tool. Update, and keep an eye on later advisories for the same plugin.
WordPress plugins run with the same trust as the rest of the site. A weakness in one small add on is a weakness in the whole install, and plugin flaws are easy to find at scale because the code is public and the plugin slugs are predictable.
Quick check
Is CVE-2025-47688 serious?
The direct effect described by Patchstack is limited to dismissing a notice, and Patchstack rates it low priority. Update anyway, since file manager plugins are powerful.
Which version fixes it?
Patchstack lists 5.3.2 as the patched version of Advanced File Manager.
Sources
Last reviewed: 18 October 2026.
