Access denied. Invalid request.

Hello,

since the automatic update of Advanced File Manager from version 5.4.12 to 5.4.13, write operations in the frontend file manager no longer work on our WordPress site.

The file manager itself loads correctly. Users can access their assigned personal directories and read permissions are working as expected. The directories also have the correct filesystem permissions.

However, any attempt to perform a write operation, for example creating a new folder, fails with the following message:

Access denied.
Invalid request. Please reload.

I can reproduce the issue with different WordPress users and different personal directories, so it does not appear to be related to a specific user or directory.

The AJAX request for creating a directory is sent correctly, for example with:

cmd=mkdir
name=Neuer Ordner
target=l1_Lw

The server responds with:

{
“error”: [
“errPerm”,
“Invalid request. Please reload.”
],
“csrfReload”: true
}

The initial request to the file manager works correctly and reports the root directory with:

read: 1
write: 1
isroot: 1

The problem appeared immediately after the automatic update from Advanced File Manager 5.4.12 to 5.4.13 on August 14, 2026. The setup and directory permissions had not been changed.

This looks like a possible regression in version 5.4.13, potentially related to the CSRF/security handling of write requests.

Could you please check whether this is a known issue with version 5.4.13?

Thank you.

Best regards,
Reiner