# WPIDE – File Manager & Code Editor <= 3.6.1 - Authenticated (Administrator+) Privilege Escalation via File Manager and Code Editor on Multisite

- **ID:** WPSEC-2026-2368
- **Plugin:** WPIDE – File Manager & Code Editor (`wpide`), https://wordpress.org/plugins/wpide/
- **Affected versions:** from 3.0 before 3.6.2
- **Fixed in:** 3.6.2 (Update to 3.6.2 or later.)
- **Severity:** High 8.0 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H)
- **Weakness:** CWE-269
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wpide
- **Fix released:** 2026-10-31
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2368/

## Description

The WPIDE – File Manager & Code Editor plugin for WordPress is vulnerable to Privilege Escalation via the file manager and code editor in versions 3.0 up to, and including, 3.6.1, due to access being granted on multisite installations based only on the manage_options capability and the administrator role rather than super admin status. This makes it possible for authenticated attackers with sub-site administrator-level access on a multisite network to read and modify files in the wp-content directory shared by the network, including plugin and theme PHP files, and execute arbitrary PHP code, exceeding the privileges normally granted to sub-site administrators. Only multisite installations are affected.

## References

- https://wpsec.com/vuln/WPSEC-2026-2368/
- https://plugins.svn.wordpress.org/wpide/tags/3.6.2/
- https://wordpress.org/plugins/wpide/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2368/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.