Known vulnerabilities stay unpatched for months
Known security vulnerabilities in the plugin's bundled elFinder library stay unpatched for months, leaving sites exposed.
Tier I · Proven The best-established problems.
8 public reports · first reported 7 July 2025 · last reported 27 October 2025
What's going wrong
Site owners report that security scanners and hosting tools such as Wordfence, Patchstack and Plesk flag WP File Manager for known flaws, including directory traversal that allows file deletion, content injection and code injection in its bundled elFinder library.
AI-assisted: written with the help of AI from the reports. The idea report has the full summary.
In the idea report
- The full summary.
- The products the 8 reports are about, and how many came each month.
- Related problems.
No business has been found with this problem yet, so the report has no contacts. All sales are final — no refunds. Pricing.