Description

The Advanced File Manager Shortcodes plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 2.5.3. This makes it possible for authenticated attackers with contributor access or above to upload arbitrary files on the affected site's server which may make remote code execution possible.

Related CPE's

a

advancedfilemanager

file_manager_advanced_shortcode

*

*

*

*

*

wordpress

Vulnerable

References

https://advancedfilemanager.com/product/file-manager-advanced-shortcode-wordpress/

Product

https://www.wordfence.com/threat-intel/vulnerabilities/id/26050f70-7a10-4df5-acd5-1c9e7613bf2c?source=cve

Third Party Advisory

Weaknesses

[email protected]

Primary
CWE-434

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.8 · High

  • CVSS V3.1

  • CVSS V3.0

  • CVSS V2.0

Information

Source identifier

[email protected]

Vulnerability status

Analyzed

Published

2024-07-10T02:15:02.740

3 months ago

Last modified

2024-08-19T14:23:34.857

2 months ago