Arbitrary File Upload Vulnerability in File Manager Pro for WordPress

CVE-2023-6846

What is CVE-2023-6846?

The File Manager Pro plugin for WordPress has a vulnerability that allows for arbitrary file uploads, which affects all versions up to and including 8.3.4. This exploit leverages the mk_check_filemanager_php_syntax AJAX function, enabling authenticated attackers with subscriber access or higher to execute code on the server. Version 8.3.5 addresses this issue by introducing a capability check to ensure that only users with admin privileges can execute this function, thereby mitigating potential risks associated with unauthorized code execution.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References