CVE-2023-6846CWE-94

File Manager Pro <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Upload

High · published February 5, 2024

CVSS v3.1

8.8

EPSS

16%

Percentile

96.9

In the wild

Unconfirmed

What it is

The File Manager Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.3.4 via the mk_check_filemanager_php_syntax AJAX function. This makes it possible for authenticated attackers, with subscriber access and above, to execute code on the server. Version 8.3.5 introduces a capability check that prevents users lower than admin from executing this function.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.15871 · 96.9th percentile
Weakness: CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published: 2024-02-05T21:27Z

EPSS history

Timeline

05 FEB 21:27Z
File Manager Pro <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Upload
cvelistv5