CVE-2024-7031
📋 TL;DR
This vulnerability in the File Manager Pro – Filester WordPress plugin allows authenticated attackers with administrator-granted permissions to modify plugin settings without proper authorization. Attackers can enable dangerous file uploads like .php files, potentially leading to remote code execution. All WordPress sites using Filester plugin versions up to 1.8.2 are affected.
💻 Affected Systems
- File Manager Pro – Filester WordPress plugin
📦 What is this software?
Filester by Ninjateam
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain remote code execution by uploading malicious PHP files, leading to complete site compromise, data theft, and server takeover.
Likely Case
Attackers modify settings to allow PHP file uploads, then upload webshells or malware to establish persistent access.
If Mitigated
With proper role-based access controls and file upload restrictions, impact is limited to unauthorized setting changes.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once an attacker has appropriate permissions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.8.3
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3129722/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'File Manager Pro – Filester' and click 'Update Now'. 4. Verify version is 1.8.3 or higher.
🔧 Temporary Workarounds
Disable vulnerable function via code modification
allAdd capability check to njt_fs_saveSettingRestrictions function
Edit wp-content/plugins/filester/includes/File_manager/FileManager.php
Add: if (!current_user_can('manage_options')) { wp_die(); } before line 566
Temporarily disable plugin
linuxDeactivate Filester plugin until patched
wp plugin deactivate filester
🧯 If You Can't Patch
- Restrict user roles and permissions to minimize attack surface
- Implement web application firewall rules to block .php file uploads
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin panel under Plugins → Installed PluginsCheck Version:
wp plugin get filester --field=versionVerify Fix Applied:
Verify Filester plugin version is 1.8.3 or higher📡 Detection & Monitoring
Log Indicators:
- POST requests to /wp-admin/admin-ajax.php with action=njt_fs_saveSettingRestrictions
- Unauthorized modifications to plugin settings
- Unexpected .php file uploads
Network Indicators:
- HTTP POST requests containing 'njt_fs_saveSettingRestrictions' parameter
SIEM Query:
source="wordpress" AND (uri_path="/wp-admin/admin-ajax.php" AND post_data="*njt_fs_saveSettingRestrictions*")🔗 References
- https://plugins.trac.wordpress.org/browser/filester/trunk/includes/File_manager/FileManager.php#L566
- https://plugins.trac.wordpress.org/changeset/3129722/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/aef584bd-60a5-4bf2-b8d3-58e3b45e785e?source=cve
- https://nowotarski.info/wordpress-nonce-authorization/
