If you're running the File Manager plugin on WordPress below version 6.9.1, the CVSS 7.5 score is misleading. This isn't a moderate information disclosure — it's an authorization bypass that exposes your admin activity log, and that data directly enables account takeover, operational replay, and forensic corruption.
The exposed log contains usernames correlated with specific file operations: which files were accessed, modified, or deleted, and when. That turns a passive disclosure into an active attack surface. You now have an adversary who knows which admin touched which configuration files, when they did it, and in what sequence. Combined with username disclosure — which enables targeted credential attacks rather than blind brute force — this moves from reconnaissance to exploitation in a single step.
But the critical point the CVSS doesn't capture: this vulnerability has a retrospective dimension that doesn't close when you patch. Activity logs accumulate. If File Manager has been installed for eighteen months, that's eighteen months of administrative workflow data — server configurations, backup locations, plugin changes — now exposed. You should assume this data was accessed during any period the plugin was unpatched, not just after disclosure.
More critically, assume the logs cannot be trusted going forward. If an attacker could read this endpoint, they almost certainly have write access unless explicit immutability controls were applied — controls no one puts on WordPress plugin logs. This transforms the vulnerability from an information disclosure into a forensic corruption opportunity. An attacker can inject false administrative actions into the log, burying their intrusion in authentic-looking operational noise and making your incident response uncertain whether what it sees ever actually happened.
Your immediate response: rotate credentials for every admin account that appears in the log, not just the current administrators. Treat the log as potentially compromised evidence — preserve a forensic copy before trusting it for incident investigation. The patch closes the disclosure; it does not restore log integrity. Assume that any timeline you reconstruct from these logs may be partially fabricated, and plan your response accordingly.