Advanced File Manager WordPress Plugin Arbitrary File Upload Vulnerability

A vulnerability allowing arbitrary file uploads has been identified in the Advanced File Manager plugin for WordPress, specifically in versions 5.2.12 to 5.2.13. This issue arises from inadequate file type validation in the 'fma_local_file_system' function. As a result, authenticated attackers with Subscriber-level access or higher, and upload permissions granted by an administrator, can upload arbitrary files to the server. This vulnerability could potentially lead to remote code execution. The issue can only be exploited if the 'Display .htaccess?' setting is enabled.

Impact

Exploitation of this vulnerability could allow for arbitrary file uploads, with the potential for remote code execution, depending on the nature of the uploaded files.

Remediation

Users are advised to update the Advanced File Manager plugin to version 5.2.14 or a newer patched version.