Executive brief
The User Access Manager plugin for WordPress, used by site administrators to control access to files and content, contains a directory traversal vulnerability that allows unauthenticated attackers to read arbitrary files from the server. An attacker can exploit this by manipulating file path parameters to access sensitive files (such as configuration files containing database credentials or API keys) without needing to log in or have special permissions.
Technical details
The vulnerability exists in the User Access Manager plugin's file handling logic, specifically in how it processes the 'uamgetfile' parameter. The flaw arises because when the attachment_url_to_postid() function returns 0 for a traversal path, the plugin falls back to using a global post object set by an attacker-supplied valid ?attachment_id parameter. This causes the access control check to pass against a legitimate public attachment while the actual file served is the attacker's chosen traversal path. The vulnerability affects all versions up to and including 2.3.15 and is exploitable by unauthenticated remote attackers over the network without any user interaction or special preconditions.
Affected products
- WordPress User Access Manager up to and including 2.3.15
Timeline
- 2026-08-02: disclosed