CVE-2024-8746: high-severity vulnerability in File Manager Pro
File Manager Pro <= 8.3.9 - Unauthenticated Backup File Download and Upload
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 0.6%
The File Manager Pro plugin for WordPress is vulnerable to arbitrary backup file downloads and uploads due to missing file type validation via the 'mk_file_folder_manager_shortcode' ajax action in all versions up to, and including, 8.3.9. This makes it possible for unauthenticated attackers, if granted access to the File Manager by an administrator, to download and upload arbitrary backup files on the affected site's server which may make remote code execution possible.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
File Manager · File Manager ProRelated CVEs — File Manager Pro
In the same product, most dangerous first.
CVE-2023-6846HIGHFile Manager Pro <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File UploadEPSS 15.9%CVE-2023-6825CRITICALFile Manager And File Manager Pro (Multiple Versions) - Directory TraversalEPSS 6.0%CVE-2025-0818MEDIUMMultiple elFinder Plugins <= (Various Versions) - Directory Traversal to Arbitrary File DeletionEPSS 1.0%CVE-2024-7559HIGHFile Manager Pro <= 8.3.7 - Authenticated (Subscriber+) Arbitrary File UploadEPSS 0.9%CVE-2023-7015MEDIUMFile Manager Pro <= 8.3.4 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2024-8918HIGHFile Manager Pro <= 8.3.9 - Unauthenticated Limited JavaScript File UploadEPSS 0.3%