What the vulnerability does
01Description
The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.8.8. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Administrators have the ability to extend file manager usage privileges to lower-level users including subscribers, which would make this vulnerability more severe on such sites.
Explanation of Vulnerability in Simple Terms
02Summary
Filester File Manager Pro versions up to 1.8.8 contain an unrestricted file upload vulnerability. An authenticated administrator can upload files without proper validation, potentially allowing them to upload executable code or malicious files to the server. This could lead to unauthorized access, data theft, or site compromise depending on where files are stored and how the server processes them.
What an attacker can do
03Attacker Capabilities
Upload files without validation to the server, potentially including executable code or malware.
Potential impact on your site
04Site Impact
A compromised admin account could upload malicious files that execute on your server, leading to data breach or complete site takeover.
Conditions required to exploit
05Prerequisites
Attacker must have administrator-level access to the site.
Key dates
06Disclosure timeline
June 14, 2025
CVE published
April 8, 2026
Record updated
