CVE-2024-1538: File Manager <= 7.2.4 - Cross-Site Request Forgery to Local JS File Inclusion
The File Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.4. This is due to missing or incorrect nonce validation on the wpfilemanager page that includes files through the 'lang' parameter. This makes it possible for unauthenticated attackers to include local JavaScript files that can be leveraged to achieve RCE via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This issue was partially patched in version 7.2.4, and fully patched in 7.2.5.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1538?
CVE-2024-1538 is classified as a Cross-Site Request Forgery (CSRF) vulnerability, which can allow unauthorized actions to be performed on behalf of a user.
How do I fix CVE-2024-1538?
To fix CVE-2024-1538, update the WordPress File Manager plugin to version 7.2.5 or later, which addresses the nonce validation issue.
What versions of the WordPress File Manager are affected by CVE-2024-1538?
All versions of the WordPress File Manager plugin up to and including 7.2.4 are affected by CVE-2024-1538.
Can CVE-2024-1538 be exploited by unauthenticated users?
Yes, CVE-2024-1538 can be exploited by unauthenticated users due to the missing or incorrect nonce validation.
What does CVE-2024-1538 affect specifically in WordPress?
CVE-2024-1538 affects the wp_file_manager page that includes files through the 'lang' parameter, exploiting the CSRF vulnerability.