Arbitrary File Upload Vulnerability in File Manager Pro's Filester Plugin

CVE-2024-8066

Summary

The Filester plugin for WordPress contains a vulnerability that allows authenticated attackers to upload arbitrary files due to inadequate validation in the 'fsConnector' function. This flaw affects all versions up to and including 1.8.4. Attackers with Subscriber-level access and higher, as granted permissions by an Administrator, can exploit this vulnerability to upload potentially malicious files, including a new .htaccess file. This could lead to severe implications, such as unauthorized remote code execution on the server hosting the affected WordPress site.

References