SVG File Sanitization Bypass in WordPress File Manager

The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone who opens it, including an administrator.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Advanced File Manager WordPress plugin before version 6.0.0 contains a stored cross-site scripting (XSS) vulnerability that fails to properly identify and sanitize SVG files before storage. This allows authenticated users with file-manager access to upload malicious SVG files containing embedded JavaScript code. When administrators or other users subsequently open these files, the scripts execute in their browsers with their privileges—a particularly critical risk since attackers can compromise administrator accounts. This vulnerability affects any WordPress installation using the vulnerable plugin version with file-manager capabilities enabled, creating a direct pathway for privilege escalation and site compromise.

Casky's skill mapping identifies this attack pattern across 323 relevant security techniques, with primary correlation to MITRE ATT&CK techniques TA0001 (Initial Access) and TA0043 (Reconnaissance). Practitioners using Casky's platform would observe detection findings focused on: (1) file upload validation bypasses showing SVG files passing through inadequate content-type checking, (2) stored XSS patterns where script payloads remain unstripped in file metadata or rendering contexts, and (3) privilege escalation indicators when file access logs show lower-privileged users uploading content subsequently accessed by administrators. Claude's extended reasoning engine would correlate these signals to surface the root cause—insufficient MIME-type validation before sanitization—and highlight the attack chain from initial upload through execution in admin browsers, enabling practitioners to implement targeted mitigations like strict file-type whitelisting and server-side SVG parsing.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-79627.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-79627

Casky has 323 skills that investigate the attack patterns behind CVE-2026-79627. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn