WPIDE – File Manager & Code Editor <= 3.6.1 - Authenticated (Administrator+) Privilege Escalation via File Manager and Code Editor on Multisite
- ID
- WPSEC-2026-2368
- Plugin
- WPIDE – File Manager & Code Editor (wpide)
- Affected
- from 3.0 before 3.6.2
- Remediation
- Update to 3.6.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
- Weakness
- CWE-269
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-03
- Attack surface
- WPIDE – File Manager & Code Editor on WPSec AttackSurface
- Fix released
- Published
Description
The WPIDE – File Manager & Code Editor plugin for WordPress is vulnerable to Privilege Escalation via the file manager and code editor in versions 3.0 up to, and including, 3.6.1, due to access being granted on multisite installations based only on the manage_options capability and the administrator role rather than super admin status. This makes it possible for authenticated attackers with sub-site administrator-level access on a multisite network to read and modify files in the wp-content directory shared by the network, including plugin and theme PHP files, and execute arbitrary PHP code, exceeding the privileges normally granted to sub-site administrators. Only multisite installations are affected.
References
- https://wpsec.com/vuln/WPSEC-2026-2368/
- https://plugins.svn.wordpress.org/wpide/tags/3.6.2/
- https://wordpress.org/plugins/wpide/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS