CVE-2024-8746 — Unrestricted File Upload in File Manager

CWE-434 — Unrestricted File Upload3 documents3 sources
Severity
8.8HIGHNVD
CNA7.5
EPSS
4.4%
top 11.02%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Filemanagerpro File ManagerFile Manager PRO
Timeline
PublishedOct 16

Description

The File Manager Pro plugin for WordPress is vulnerable to arbitrary backup file downloads and uploads due to missing file type validation via the 'mk_file_folder_manager_shortcode' ajax action in all versions up to, and including, 8.3.9. This makes it possible for unauthenticated attackers, if granted access to the File Manager by an administrator, to download and upload arbitrary backup files on the affected site's server which may make remote code execution possible.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-5rmg-2f4g-8wm7: The File Manager Pro plugin for WordPress is vulnerable to arbitrary backup file downloads and uploads due to missing file type validation via the 'mk↗2024-10-16
▶
CVEList
File Manager Pro <= 8.3.9 - Unauthenticated Backup File Download and Upload↗2024-10-16
▶
CVE-2024-8746 — Unrestricted File Upload | cvebase