Cross-Site Request Forgery vulnerability in File Manager Pro plugin

CVE-2024-8507

8.8HIGH

Key Information

Vendor: Filemanagerpro
Status: File Manager
Vendor: CVE Published:; 16 October 2024

Summary

The File Manager Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.3.9. This is due to missing or incorrect nonce validation on the 'mk_file_folder_manager' ajax action. This makes it possible for unauthenticated attackers to upload arbitrary files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVSS V3.1

Score:

8.8

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Unchanged

Timeline

Vulnerability published.
Oct 16, 2024

Collectors

NVD Database