CVE-2024-8126: Advanced File Manager <= 5.2.8 - Authenticated (Subscriber+) Arbitrary File Upload
The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads via the 'classfmaconnector.php' file in all versions up to, and including, 5.2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an Administrator, to upload a new .htaccess file allowing them to subsequently upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8126?
CVE-2024-8126 is classified as a high-severity vulnerability due to the potential for arbitrary file uploads.
How do I fix CVE-2024-8126?
To fix CVE-2024-8126, update the Advanced File Manager plugin to version 5.2.9 or later.
Who is affected by CVE-2024-8126?
CVE-2024-8126 affects all versions of the Advanced File Manager plugin up to and including 5.2.8.
What types of attacks are possible with CVE-2024-8126?
CVE-2024-8126 allows authenticated attackers, with Subscriber-level access and above, to perform unauthorized file uploads.
Is there a patch available for CVE-2024-8126?
Yes, version 5.2.9 of the Advanced File Manager plugin includes a patch for CVE-2024-8126.