CVE-2026-15991 is a critical authorization bypass in the elFinder file manager library as deployed through WordPress plugins. The vulnerability stems from a mismatch between where permissions are registered and where commands are dispatched: the bind() handler reads command registration exclusively from $_POST, but the dispatcher reads the cmd parameter from the merged $_GET+$_POST superglobal. This means if you send cmd=rm in a query string while posting other data, the permission layer never registers the rm command, but the execution layer finds it anyway and runs it with whatever permissions were last active.
The severity is extreme for three compounding reasons. First, subscriber-level access—WordPress's lowest privilege tier—is sufficient to exploit this. Subscriber accounts can often be created freely or obtained through spam registrations. Second, the default volume is ABSPATH, meaning the attacker starts at the filesystem root with no path traversal needed. Third, and most concerning, deleting wp-config.php is explicitly achievable, which breaks WordPress entirely and forces a reinstallation—allowing the attacker to control the admin account and achieve full RCE.
What defenders should do now: audit any WordPress installations running File Manager or elFinder-based plugins and confirm the plugin version has the bind() fix that reads from a consistent request source. If you cannot patch immediately, consider disabling the plugin entirely—the blast radius of subscriber-controlled file deletion at ABSPATH outweighs the convenience of the file manager. Network-level detection is difficult because the attack uses the legitimate file manager interface with valid POST data; the only anomalous signal is cmd=rm appearing in the query string rather than exclusively in the POST body. Correlate file deletion events with subscriber sessions in your SIEM—this is the only behavioral signal available. Be aware that this same $_POST vs $_GET+$_POST pattern likely exists in other elFinder integrations beyond WordPress (legacy CMSes, hosting panels, internal tools), so the vulnerability has supply chain reach beyond this specific plugin.