CVE-2023-4861 File Manager Pro < 1.8.1 - Admin+ Remote Code Execution
Admin users can upload arbitrary files to achieve remote code execution, posing a risk in multisite environments.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-4861?
CVE-2023-4861 is a high-severity vulnerability in Unknown File Manager Pro, published on 16 Oct 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The File Manager Pro WordPress plugin before 1.8.1 allows admin users to upload arbitrary files, even in environments where such a user should not be able to gain full control of the server, such as a multisite installation. This leads to remote code execution.
Which versions are affected by CVE-2023-4861?
It affects 1 product.
Products include Ninjateam Filester.
How do I fix CVE-2023-4861?
No fix has been published for CVE-2023-4861 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-4861 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-4861 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Unknown File Manager Pro
- CVE-2023-4827 File Manager Pro < 1.8 - Remote Code Execution via CSRF
- CVE-2024-8066 File Manager Pro – Filester <= 1.8.6- Authenticated (Subscriber+) Arbitrary File Upload
- CVE-2024-7031 File Manager Pro – Filester <= 1.8.2 - Authenticated Plugin Settings Update
- CVE-2024-9669 File Manager Pro – Filester <= 1.8.5 - Authenticated (Administrator+) Local JavaScript File Inclusion
- CVE-2023-4862 File Manager Pro < 1.8.1 - Admin+ Stored Cross-Site Scripting
Sources
Also known as GHSA-qmv3-76vc-754w.