Arbitrary File Upload Vulnerability in File Manager Pro for WordPress

CVE-2023-6846

Summary

The File Manager Pro plugin for WordPress has a vulnerability that allows for arbitrary file uploads, which affects all versions up to and including 8.3.4. This exploit leverages the mk_check_filemanager_php_syntax AJAX function, enabling authenticated attackers with subscriber access or higher to execute code on the server. Version 8.3.5 addresses this issue by introducing a capability check to ensure that only users with admin privileges can execute this function, thereby mitigating potential risks associated with unauthorized code execution.

References