Arbitrary File Uploads Vulnerability in File Manager Pro for WordPress

CVE-2024-7559

Summary

The File Manager Pro plugin for WordPress is susceptible to arbitrary file uploads due to inadequate file type validation and lack of appropriate capability checks in the mk_file_folder_manager AJAX action. This vulnerability affects all versions up to and including 8.3.7, enabling authenticated users with Subscriber-level access and above to upload potentially malicious files to the server. By exploiting this flaw, attackers could potentially execute remote code on the affected WordPress site, leading to significant security breaches.

References