Best File Manager Plugins for WordPress

File manager plugins for WordPress hand you a working shell in the browser, which is exactly why they are useful and exactly why they get sites compromised. Grant one to the wrong role and a Subscriber can read wp-config.php. Two plugins this roundup used to recommend have since been closed on WordPress.org for security issues. Below is what still ships in 2026, what it really costs at renewal, how to lock the permissions down, and when to close the tab and open SFTP instead.

Plugin	What it manages	Free version	Paid entry price	Renewal	Currency served
Advanced File Manager	Server filesystem	Yes	$49.99/yr (Basic, 1 site)	$49.99/yr	USD
FileOrganizer	Server filesystem	Yes	$12/yr (Personal, 1 site)	$12/yr	USD
Filester	Server filesystem	Yes, everything	No paid tier	None	n/a
File Manager (WP File Manager)	Server filesystem	Yes	$39 one-time (Basic, 1 site)	None stated	USD
FileBird	Media library folders	Yes	$49/yr list, $39 at check date	Not stated	USD
Real Media Library	Media library folders	Yes	39 € gross, lifetime licence	None; 1 yr support	EUR
Folders	Media, pages, posts, CPT folders	Yes	$69/yr, or $175 lifetime	Not stated	USD
Wicked Folders	Posts, CPTs, users, media folders	Yes	$49 (Personal, 1 site)	$24.50/yr (50% renewal discount)	USD

The split down the middle of that table is the thing to understand before you install anything. The first four plugins read and write your actual server filesystem, wp-config.php included. The last four only add a folder taxonomy on top of the media library and cannot touch a server file. Same category page, wildly different blast radius.

Advanced File Manager

This is the one to reach for when a client has no FTP account. Advanced File Manager runs an elFinder-style two-pane browser over the whole server root, with a code editor, archive create and extract, previews, and a shortcode that puts a document list on the front end. On 100,000 active installs and version 5.4.13 as of 13 August 2026, tested against WordPress 7.0.4.

• Key features: full filesystem browser, built-in editor with syntax checking, zip and tar handling, per-role access rules, Dropbox, Google Drive and OneDrive connectors in Pro, front-end file lists by shortcode.
• Price: free on WordPress.org. Pro starts at $49.99 a year for one site, with Professional at $69.99 and Business at $79.99, or $599.99 once for unlimited sites (vendor pricing page).
• Best for: agencies that want one tool covering both admin-side server access and a client-facing document library.
• Skip it if: you intend to hand file access to non-administrators. CVE-2026-11565, published 19 August 2026 at CVSS 8.5, let any role an admin had granted file-manager access read arbitrary server files and overwrite non-PHP ones. It is fixed in 5.4.13, but the pattern repeats.

Credit where it is due: the fix landed before the advisory did. That is the cadence you want, and it is more than you can say for some of the alternatives. Just do not confuse fast patching with a small attack surface.

FileOrganizer

Softaculous took FileOrganizer over and it is now the cheapest supported way to buy a filesystem manager. It reaches outside the WordPress root, which matters when you need to look at a log file or a stray backup sitting one directory up. 200,000 active installs, version 1.2.0 from June 2026.

• Key features: file and directory operations, drag-and-drop uploads, built-in code editor, zip and tar create and extract, previews for PDFs, images, audio and video, search, access outside the WordPress root.
• Price: free. Pro is $12 a year for one site, $60 a year for ten and $199 a year for unlimited (vendor pricing page). At $12 that is the cheapest annual licence in this table by a wide margin.
• Best for: freelancers who want a paid, supported tool without an agency-sized invoice.
• Skip it if: you need front-end document libraries or cloud storage connectors. This is an admin tool and nothing else.

Filester

Filester is the odd one out: Ninja Team release the full product free, with no pro tier behind it. That screenshot is the honest sales pitch and the honest warning at the same time. It is the WordPress root, in a browser, with wp-config.php sitting there waiting to be double-clicked.

• Key features: elFinder interface with selectable themes, code editor, archive handling, role restrictions, activity notifications, and a directory tree that starts at public_html.
• Price: free, all of it. The product page says plainly that you will not be asked to upgrade.
• Best for: one-off server surgery on a site where nobody can find the FTP credentials. Install, fix, delete.
• Skip it if: you want a support contract. Free means community forums. The current build is 2.1.2, from 23 August 2026.

If you are only in there to drop in a snippet, a code snippet plugin is the safer habit. It keeps your changes in the database and out of the theme files.

File Manager (WP File Manager)

At 1,000,000 active installs, File Manager is far and away the most installed plugin in this roundup. It is also the one carrying the worst history. CVE-2020-25213, disclosed in September 2020, let unauthenticated attackers upload and run PHP because an example elFinder connector had been renamed to a .php extension. NVD scores it 9.8. It was exploited at scale within days.

• Key features: filesystem browser, code editor with syntax checking, archive support, email notification on file changes, and cloud connectors plus front-end access in Pro.
• Price: free. Pro is $39 once for one site, $199 for ten and $399 for twenty-five, all sold as lifetime-updates licences (vendor pricing page). No renewal price is stated.
• Best for: people who want a one-time payment rather than a subscription.
• Skip it if: maintenance cadence matters to you. Version 8.0.4 shipped on 21 April 2026 and is tested only to WordPress 6.9.7, while Filester, FileBird, Real Media Library and Folders are all tested to 7.1.

The 2020 bug is patched and has been for years. We are not holding it against the current code. We are holding it up as the clearest illustration of what a file manager plugin actually is: one missing check away from being a public upload endpoint.

FileBird

Now the other half of the table. FileBird adds folders to the media library and nothing else, which is why it belongs in a different mental bucket from everything above. 200,000 active installs, version 6.5.8 from 22 August 2026.

• Key features: unlimited nested folders in the media library and the media inserter, drag-and-drop and bulk move, right-click context menu, colour-coded folders, folder themes, and a gallery block that renders a folder on the front end.
• Price: free. Pro lists at $49 a year for one site, discounted to $39 at the check date, with lifetime licences from $149 discounted to $99 (vendor pricing page). The page does not state a renewal figure, so confirm it at checkout.
• Best for: sites with thousands of uploads where the media grid has become unusable.
• Skip it if: you need to touch server files. It cannot, by design. Note also CVE-2025-6986, an Author-level SQL injection through the search parameter affecting versions through 6.4.8, published August 2025 and long since fixed.

Folder plugins do not move anything on disk, so they will not fix a slow media library on their own. If the grid is crawling because every upload is a 4 MB PNG, you want image optimization plugins first.

Real Media Library

Real Media Library from devowl.io is the more polished of the two big folder plugins, and the one billed in euros. 100,000 active installs, version 4.23.0 from 18 August 2026, tested to WordPress 7.1.

• Key features: drag-and-drop folder tree in the media library, file shortcuts so one upload can live in several folders, custom folder ordering, and gallery and slider integrations.
• Price: free. PRO starts at 39 € gross for one site, then 79 € for three, 119 € for five, 199 € for ten and 299 € for twenty-five (vendor pricing page). Every tier is a lifetime licence with lifetime updates and one year of support; the page states that all prices include VAT.
• Best for: EU-based agencies who would rather have a VAT-inclusive euro invoice and a one-time payment.
• Skip it if: you need more than a year of support, or you want a USD invoice. The licence covers lifetime updates but the vendor page states one year of support.

We have deliberately not ranked those euro prices against the dollar prices in the table. Currency conversion moves, VAT rates differ by country, and a comparison built on today’s rate is wrong by next quarter.

Folders

Premio’s Folders covers more than media. It puts folders on pages, posts and custom post types too, which makes it the closest thing here to a general-purpose organiser. 90,000 active installs, version 3.1.9 from 13 August 2026.

• Key features: unlimited folders across media, pages, posts and custom post types, drag-and-drop, starred folders, folder colours and fonts, and download a whole folder as a ZIP.
• Price: free. Pro is $69 a year for one site, $99 for two years, or $175 as a lifetime licence (vendor pricing page). At those numbers the lifetime option pays for itself in the third year: two years of the annual plan is $138, three years is $207.
• Best for: content teams drowning in pages as much as in images.
• Skip it if: you are watching entry prices. That $69 is the highest starting price of the USD-billed plugins in the table. Worth noting too: CVE-2023-40204 was an unrestricted file upload flaw affecting versions through 2.9.2, so even a folder plugin managed to ship a 9.1.

Wicked Folders

Wicked Folders is the specialist. It organises post types, users, plugins, WooCommerce products and orders, Gravity Forms entries, WPForms and TablePress, and treats the media library as one target among many. 20,000 active installs, version 4.1.3 from 23 June 2026.

• Key features: folders for pages, posts and custom post types in the free build, plus dynamic folders that group content by author, date, hierarchy, file extension or category. Pro adds media, user, plugin, WooCommerce, forms and TablePress folders, and folder permission policies.
• Price: free edition, then Pro at $49 for one site or $149 for unlimited sites, each sold as one year of plugin updates (vendor pricing page).
• Best for: sites with a sprawl of custom post types where the admin list tables have become unmanageable.
• Skip it if: you only care about images. FileBird and Real Media Library do the media library better.

The catch: this is a remote shell with a folder icon

On 6 July 2026, NVD published CVE-2026-6382 at CVSS 9.1. FileOrganizer before 1.1.9, Advanced File Manager before 5.4.12, File Manager Pro before 2.1.1 and File Manager before 8.0.4 all failed to escape a parameter before passing it to a shell command during image operations, allowing OS command injection by an authenticated user. One bug. Four plugins. They share elFinder ancestry, so they share defects.

That is the honest framing this category needs. It is not that these developers are careless. It is that a file manager plugin is, functionally, a web-exposed shell, and shells are hard. The vulnerability history bears it out: CVE-2024-8126 in 2024 let a Subscriber-level account upload a .htaccess file and then arbitrary files, and the August 2026 advisory in the Advanced File Manager section above let a granted role read arbitrary server configuration files.

Two plugins that appeared in the previous version of this list are gone entirely. SP Project and Document Manager was closed on 7 March 2024, reason given: security issue. Secure File Manager was closed on 1 September 2021, same reason. Neither is downloadable from the repository. If either is still active on a site you look after, remove it today and run a malware scan before you assume you got there first.

Seven rules that actually reduce the risk

• Never grant file access below Administrator. Read the recent advisories and the same phrase keeps appearing: Subscriber-level access and above, granted permissions by an Administrator. The escalation path exists because somebody ticked a box.
• Turn off front-end and public file access unless the site is genuinely a download portal. Those modules are the difference between an admin tool and an internet-facing one.
• Do not mistake DISALLOW_FILE_EDIT for protection. That wp-config.php constant only disables the built-in theme and plugin editor. A file manager plugin uses its own code paths and keeps working regardless. Set it anyway, but set it knowing that.
• Update the same day. These vendors patch fast. Your exposure is the gap between their release and your update, and after disclosure that gap gets scanned.
• Back up before you touch anything. One saved wp-config.php with a stray character takes the whole site down. Have a backup plugin configured before you open the editor, not after.
• Harden the login. Every one of these advisories starts with an authenticated account. Two-factor and brute-force protection on the admin accounts matter more here than on an average site.
• Delete it when you are done. Deactivating leaves the files on disk. Delete the plugin. Pair that habit with one of the WordPress security plugins if the site does not already have monitoring.

When to use SFTP instead

Most of the time, if you have SFTP or SSH, that is the correct answer and this whole page is optional reading. Use the credentials your host already gave you when:

• The site is throwing a fatal error. No admin means no plugin, and the file manager you installed for exactly this emergency is now unreachable.
• You are editing wp-config.php or .htaccess. Those are the two files where a typo takes the site down, and you want a route back in that does not depend on WordPress booting.
• You are moving more than a few hundred megabytes. Browser uploads hit PHP limits; SFTP does not care.
• The site handles anything sensitive. One fewer plugin with write access to disk is one fewer thing to patch.

The plugin wins in narrower cases: shared hosting where the client was never issued an SFTP account, a quick edit from a network that blocks port 22, or a non-technical client who needs somewhere to drop PDFs. If you are choosing a host and this comes up often, SSH access is worth putting on the requirements list. Our notes on WordPress hosting platforms and on choosing a host both cover it.

Local work is different again. On a XAMPP or Local install you already have the filesystem open in Finder or Explorer, so a file manager plugin adds nothing. That is the environment where you are more likely to be fighting configuration issues such as enabling WebP uploads in XAMPP.

Which one should you install

• You need server files, one job, then out: Filester. Free, complete, current, delete it afterwards.
• You need server files regularly and want support: FileOrganizer at $12 a year, or Advanced File Manager at $49.99 a year if you need cloud connectors and front-end lists.
• You want a one-time payment: File Manager at $39, with the maintenance caveat above.
• You only need folders in the media library: FileBird if you invoice in dollars, Real Media Library if you invoice in euros.
• You need folders on posts, pages and custom post types: Folders for a general team tool, Wicked Folders if the sprawl is in custom post types and form entries.
• You have SFTP: nothing. Close the tab.

One more scenario worth naming: if the reason you are reaching for a file manager is that you are moving a site between hosts, stop. That is a job for a migration plugin, which moves the database along with the files.

Frequently Asked Questions

Our call

Install Filester when you need to get at server files and delete it when you are finished. It is free, it is current, and there is no upsell attached. If you do this often enough that support is worth paying for, FileOrganizer at $12 a year is the cheapest sensible upgrade, and Advanced File Manager at $49.99 a year is the one to buy when you need cloud connectors and front-end document lists on client sites.

If your actual problem is a media library with four thousand unsorted images in it, none of the above applies. Buy FileBird or Real Media Library, add folders, and never give a plugin write access to your server root in the first place.

And if your host gave you SFTP, use SFTP. Every file manager plugin in this roundup is a convenience that costs you attack surface. Sometimes that trade is worth making. Make it deliberately, for a specific job, and undo it afterwards.