File Manager Pro - Filester WordPress Plugin Arbitrary File Upload Vulnerability

A vulnerability allowing arbitrary file uploads has been identified in the File Manager Pro - Filester plugin for WordPress, affecting all versions through 1.8.8. This issue arises from inadequate file type validation, enabling authenticated attackers with Administrator-level access to upload arbitrary files to the server. Such uploads could potentially lead to remote code execution. Additionally, administrators can grant file manager privileges to lower-level users, including subscribers, which could exacerbate the impact of this vulnerability on those sites.

Impact

Exploitation of this vulnerability could allow for arbitrary file uploads, with the potential for remote code execution, especially if the uploaded files are executed on the server.

Remediation

Users are advised to update the File Manager Pro - Filester plugin to version 1.8.9 or a newer patched version.