CVE-2024-8066: File Manager Pro – Filester <= 1.8.6- Authenticated (Subscriber+) Arbitrary File Upload
First published: Thu Nov 28 2024(Updated: )
The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file uploads due to missing validation in the 'fsConnector' function in all versions up to, and including, 1.8.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an Administrator, to upload a new .htaccess file allowing them to subsequently upload arbitrary files on the affected site's server which may make remote code execution possible.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| File Manager Pro | <=1.8.6 | |
| <1.8.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-8066?
CVE-2024-8066 has a high severity due to its potential for arbitrary file uploads by authenticated attackers.
How do I fix CVE-2024-8066?
To fix CVE-2024-8066, update the File Manager Pro – Filester plugin to version 1.8.7 or above.
Which versions are vulnerable to CVE-2024-8066?
All versions of the File Manager Pro – Filester plugin up to and including version 1.8.6 are vulnerable to CVE-2024-8066.
Who can exploit CVE-2024-8066?
Authenticated users with Subscriber-level access and above can exploit CVE-2024-8066.
What kind of vulnerability is CVE-2024-8066?
CVE-2024-8066 is a vulnerability that allows for arbitrary file uploads due to improper validation in the plugin.
- agent/references
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/author
- agent/title
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/severity
- agent/last-modified-date
- agent/remedy
- agent/event
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- vendor/file manager pro
- canonical/file manager pro
- vendor/ninjateam