Security readout for executives and security teams
Plain-English summary
This CVE describes a cross-site request forgery issue in File Manager plugin 3.0 for WordPress. A user with an authenticated WordPress session could potentially be induced to submit an unintended change involving the public_path parameter. The public sources do not state impact, fixed versions, or exploitation in the wild.
Executive priority
Treat this as an exposure-confirmation task, not an emergency based on current evidence. Prioritize sites using this exact WordPress plugin version, especially externally accessible or business-critical sites.
Technical view
CVE-2018-16966 is reported as CSRF in mndpsingh287 File Manager plugin 3.0 for WordPress, tied to the page=wp_file_manager_root public_path parameter. The record provides no CVSS score, CWE, complete CPE, or confirmed remediation details. KEV status is false.
Likely exposure
Exposure is limited to WordPress installations running the mndpsingh287 File Manager plugin version 3.0. The bundle does not identify other affected versions or products.
Exploitation context
No source in the bundle reports active exploitation, and the CVE is not listed as KEV. CSRF typically depends on a victim using an authenticated browser session, but this record does not document the full attack impact.
Researcher notes
The record is sparse: no CVSS, CWE, CPE, impact statement, proof of active exploitation, or fixed version is provided in the bundle. Analysis should remain constrained to File Manager plugin 3.0 and the named public_path CSRF issue.
Mitigation direction
- Inventory WordPress sites for File Manager plugin version 3.0 by mndpsingh287.
- Check the WordPress plugin page and vendor guidance for fixed-version information.
- Disable or remove the plugin if no maintained safe version can be confirmed.
- Restrict WordPress administrator access to trusted users and managed devices.
Validation and detection
- Confirm installed plugin name, author, and version on each WordPress site.
- Review whether page=wp_file_manager_root is present in the plugin administration surface.
- Check available plugin changelog notes against CVE-2018-16966.
- Document compensating controls where plugin removal is not immediately possible.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-16966 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://wordpress.org/plugins/wp-file-manager/#developersCVE reference · x_refsource_MISC
- https://ansawaf.blogspot.com/2019/04/file-manager-plugin-wordpress-plugin.htmlCVE reference · x_refsource_MISC
- https://wpvulndb.com/vulnerabilities/9614CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.