Directory Traversal Vulnerability in WordPress File Manager by Studio 42

CVE-2023-6825

Summary

The File Manager and File Manager Pro plugins for WordPress contain a vulnerability that allows for directory traversal, exposing sensitive files on the server. This occurs due to improper validation of the target parameter within the mk_file_folder_manager_action_callback_shortcode function. Attackers can potentially access and read files located outside the intended directory, including sensitive configuration files. In the free version, administrator privileges are required for successful exploitation, while the Pro version's design permits file handling to be embedded via a shortcode. This problem is exacerbated by the ability of admins to assign file handling capabilities to lower-level users, making it easier for them to exploit this vulnerability.

References