Unauthorized Modification of Data via Missing Capability Check in File Manager Pro

CVE-2024-7031

Summary

The File Manager Pro – Filester plugin for WordPress exhibits a vulnerability that enables unauthorized data modification due to the absence of a capability check in the 'njt_fs_saveSettingRestrictions' function. All versions up to and including 1.8.2 are susceptible, allowing attackers with certain authenticated roles to alter plugin settings for user role restrictions. This includes the alarming ability to permit the upload of potentially malicious file types, such as .php, which could lead to further exploitation of the affected WordPress installations.

References