CVE-2024-8507: File Manager Pro <= 8.3.9 - Cross-Site Request Forgery to Arbitrary File Upload
The File Manager Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.3.9. This is due to missing or incorrect nonce validation on the 'mkfilefoldermanager' ajax action. This makes it possible for unauthenticated attackers to upload arbitrary files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8507?
CVE-2024-8507 is classified as a Cross-Site Request Forgery vulnerability, which may allow unauthenticated attackers to perform actions on behalf of users.
How do I fix CVE-2024-8507?
To fix CVE-2024-8507, update the File Manager Pro plugin to version 8.3.10 or later to ensure proper nonce validation.
Who is affected by CVE-2024-8507?
CVE-2024-8507 affects all versions of the File Manager Pro plugin for WordPress up to and including version 8.3.9.
What causes CVE-2024-8507?
CVE-2024-8507 is caused by missing or incorrect nonce validation on the 'mk_file_folder_manager' ajax action.
Can CVE-2024-8507 be exploited remotely?
Yes, CVE-2024-8507 can be exploited remotely by unauthenticated attackers due to the nature of the Cross-Site Request Forgery vulnerability.