CVE-2024-8746 File Manager Pro <= 8.3.9 - Unauthenticated Backup File Download and Upload

What is CVE-2024-8746?

CVE-2024-8746 is a high-severity vulnerability in File Manager Pro, published on 16 Oct 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The File Manager Pro plugin for WordPress is vulnerable to arbitrary backup file downloads and uploads due to missing file type validation via the 'mk_file_folder_manager_shortcode' ajax action in all versions up to, and including, 8.3.9. This makes it possible for unauthenticated attackers, if granted access to the File Manager by an administrator, to download and upload arbitrary backup files on the affected site's server which may make remote code execution possible.

Weakness: CWE-434

Which versions are affected by CVE-2024-8746?

It affects 1 product.

Products include Filemanagerpro File Manager.

How do I fix CVE-2024-8746?

No fix has been published for CVE-2024-8746 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-8746 being exploited?

There is no known exploitation of CVE-2024-8746 in the wild and no public exploit code.

Other vulnerabilities in File Manager Pro

• CVE-2020-25213 WordPress File Manager Plugin Remote Code Execution Exploited Critical 10.0
• CVE-2018-25105 File Manager <= 3.0 - Unauthenticated Arbitrary File Upload/Download Critical 9.8
• CVE-2024-8507 File Manager Pro <= 8.3.9 - Cross-Site Request Forgery to Arbitrary File Upload High 8.8
• CVE-2024-1538 File Manager <= 7.2.4 - Cross-Site Request Forgery to Local JS File Inclusion High 8.8
• CVE-2023-6846 File Manager Pro <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Upload High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5rmg-2f4g-8wm7.