{
 "id": "WPSEC-2026-2368",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2368/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2368/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2368/index.md",
 "title": "WPIDE – File Manager & Code Editor <= 3.6.1 - Authenticated (Administrator+) Privilege Escalation via File Manager and Code Editor on Multisite",
 "description": "The WPIDE – File Manager & Code Editor plugin for WordPress is vulnerable to Privilege Escalation via the file manager and code editor in versions 3.0 up to, and including, 3.6.1, due to access being granted on multisite installations based only on the manage_options capability and the administrator role rather than super admin status. This makes it possible for authenticated attackers with sub-site administrator-level access on a multisite network to read and modify files in the wp-content directory shared by the network, including plugin and theme PHP files, and execute arbitrary PHP code, exceeding the privileges normally granted to sub-site administrators. Only multisite installations are affected.",
 "plugin": {
  "slug": "wpide",
  "name": "WPIDE – File Manager & Code Editor",
  "full_name": "WPIDE – File Manager & Code Editor",
  "wordpress_org": "https://wordpress.org/plugins/wpide/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wpide/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wpide"
 },
 "type": "PRIV",
 "cwe": [
  "CWE-269"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 8.0,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.0",
    "from_inclusive": true,
    "to": "3.6.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.0 before 3.6.2"
  ]
 },
 "introduced_in": "3.0",
 "fixed_in": "3.6.2",
 "remediation": "Update to 3.6.2 or later.",
 "fix_released": "2026-10-31T05:53:57+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:40:48.069729+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2368/",
  "https://plugins.svn.wordpress.org/wpide/tags/3.6.2/",
  "https://wordpress.org/plugins/wpide/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wpide",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-03"
 }
}