Vulnerability in File Manager Pro's Filester plugin for WordPress allows arbitrary file inclusion

CVE-2024-9669

Summary

The Filester plugin for WordPress, particularly versions up to and including 1.8.5, is susceptible to a Local JavaScript File Inclusion vulnerability. Exploitation of this issue allows authenticated users with Administrator-level access to include and execute arbitrary files on the server. It poses significant risks, enabling the bypassing of access controls, extraction of sensitive data, and execution of malicious PHP code through included files. The vulnerability targets the 'fm_locale' parameter, and while a partial patch was released in version 1.8.5, the potential for exploitation remains a concern.

References