CVE-2024-9669: File Manager Pro – Filester <= 1.8.5 - Authenticated (Administrator+) Local JavaScript File Inclusion
First published: Thu Nov 28 2024(Updated: )
The File Manager Pro – Filester plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and including, 1.8.5 via the 'fm_locale' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. The vulnerability was partially patched in version 1.8.5.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| File Manager Pro | <=1.8.5 | |
| <1.8.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/7d947023-60d3-4bd8-b45d-e1663326d6c1?source=cve
- https://plugins.trac.wordpress.org/browser/filester/trunk/includes/File_manager/FileManager.php#L250
- https://plugins.trac.wordpress.org/browser/filester/trunk/views/pages/html-filemanager.php#L3
- https://plugins.trac.wordpress.org/changeset/3186518/
- https://plugins.trac.wordpress.org/changeset/3196150/
Frequently Asked Questions
What is the severity of CVE-2024-9669?
CVE-2024-9669 has a high severity rating due to its potential for Local JavaScript File Inclusion by authenticated attackers.
How do I fix CVE-2024-9669?
To fix CVE-2024-9669, update the File Manager Pro – Filester plugin to version 1.8.6 or later.
Who is affected by CVE-2024-9669?
CVE-2024-9669 affects all versions of the File Manager Pro – Filester plugin for WordPress up to and including version 1.8.5.
Can attackers exploit CVE-2024-9669 remotely?
No, attackers must have Administrator-level access to exploit CVE-2024-9669.
What kind of attacks could CVE-2024-9669 facilitate?
CVE-2024-9669 could facilitate attacks that include malicious JavaScript files, potentially leading to user data compromise.
- agent/title
- agent/references
- agent/weakness
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/severity
- collector/mitre-cve
- source/MITRE
- agent/trending
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/source
- agent/last-modified-date
- agent/remedy
- agent/event
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- vendor/file manager pro
- canonical/file manager pro
- vendor/ninjateam