CVE-2024-8066
📋 TL;DR
The File Manager Pro – Filester WordPress plugin up to version 1.8.6 allows authenticated attackers with Subscriber-level access (and administrator-granted permissions) to upload arbitrary files, including .htaccess files, potentially leading to remote code execution. This affects all WordPress sites using vulnerable versions of the Filester plugin.
💻 Affected Systems
- File Manager Pro – Filester WordPress plugin
📦 What is this software?
Filester by Ninjateam
⚠️ Risk & Real-World Impact
Worst Case
Full site compromise through remote code execution, data theft, defacement, or malware distribution.
Likely Case
Unauthorized file upload leading to backdoor installation, privilege escalation, or site manipulation.
If Mitigated
Limited impact if proper file validation and access controls prevent successful exploitation.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once permissions are granted.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.8.7
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3186518/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'File Manager Pro – Filester'. 4. Click 'Update Now' if available, or manually update to version 1.8.7+. 5. Verify update completes successfully.
🔧 Temporary Workarounds
Disable Filester plugin
allTemporarily deactivate the vulnerable plugin until patched.
wp plugin deactivate filester
Restrict file upload permissions
allLimit which user roles can access the file manager functionality.
🧯 If You Can't Patch
- Remove Subscriber role access to Filester plugin entirely.
- Implement web application firewall rules to block .htaccess file uploads.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > File Manager Pro – Filester version. If version is 1.8.6 or lower, you are vulnerable.Check Version:
wp plugin get filester --field=versionVerify Fix Applied:
Confirm plugin version is 1.8.7 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads via /wp-content/plugins/filester/
- .htaccess file modifications in unexpected locations
- POST requests to filester file manager endpoints
Network Indicators:
- HTTP POST requests to /wp-content/plugins/filester/includes/File_manager/ with file upload parameters
SIEM Query:
source="web_logs" AND uri_path="/wp-content/plugins/filester/" AND method="POST" AND (form_data LIKE "%htaccess%" OR form_data LIKE "%php%" OR form_data LIKE "%shell%")