CVE-2024-13333: Advanced File Manager 5.2.12 - 5.2.13 - Authenticated (Subscriber+) Arbitrary File Upload
The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fmalocalfilesystem' function in versions 5.2.12 to 5.2.13. This makes it possible for authenticated attackers, with Subscriber-level access and above and upload permissions granted by an administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible. The function can be exploited only if the "Display .htaccess?" setting is enabled.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13333?
CVE-2024-13333 has a severity rating that indicates it can be exploited by authenticated attackers to upload arbitrary files.
How do I fix CVE-2024-13333?
To fix CVE-2024-13333, update the Advanced File Manager plugin to the latest version that addresses the arbitrary file upload vulnerability.
Who is affected by CVE-2024-13333?
CVE-2024-13333 affects users of the Advanced File Manager plugin versions 5.2.12 and 5.2.13 on WordPress.
What types of attacks are possible with CVE-2024-13333?
CVE-2024-13333 allows attackers with Subscriber-level access to upload malicious files to the server.
What versions of Advanced File Manager are impacted by CVE-2024-13333?
Versions 5.2.12 to 5.2.13 of the Advanced File Manager plugin are impacted by CVE-2024-13333.