CVE-2024-8746
📋 TL;DR
The File Manager Pro WordPress plugin allows unauthenticated attackers to download and upload arbitrary backup files through an AJAX endpoint without proper file type validation. This vulnerability affects all WordPress sites using File Manager Pro versions up to 8.3.9. Attackers who gain access to the file manager interface can potentially achieve remote code execution.
💻 Affected Systems
- File Manager Pro WordPress Plugin
📦 What is this software?
File Manager by Filemanagerpro
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete server compromise, data theft, malware deployment, and website defacement.
Likely Case
Unauthorized file upload/download leading to information disclosure, backdoor installation, or privilege escalation.
If Mitigated
Limited impact if file manager access is restricted and proper file permissions are in place.
🎯 Exploit Status
Exploitation is straightforward once an attacker gains access to the file manager interface. The vulnerability is in a publicly accessible AJAX endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.4.0 or later
Vendor Advisory: https://filemanagerpro.io/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find File Manager Pro. 4. Click 'Update Now' if available. 5. If not available, download version 8.4.0+ from vendor site and manually update.
🔧 Temporary Workarounds
Disable File Manager Access
allRemove or restrict access to the file manager interface for all non-administrative users.
Remove Plugin
allTemporarily disable or remove the File Manager Pro plugin until patched.
🧯 If You Can't Patch
- Implement strict file upload validation at web application firewall level
- Restrict access to /wp-admin/admin-ajax.php endpoint for unauthenticated users
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → File Manager Pro version. If version is 8.3.9 or lower, you are vulnerable.Check Version:
wp plugin list --name='File Manager Pro' --field=version (if WP-CLI installed)Verify Fix Applied:
Verify File Manager Pro version is 8.4.0 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads/downloads via admin-ajax.php
- POST requests to admin-ajax.php with action=mk_file_folder_manager_shortcode
- Unexpected .zip, .tar, or backup file operations
Network Indicators:
- Unusual traffic to /wp-admin/admin-ajax.php with file upload/download parameters
- Large file transfers to/from WordPress admin endpoints
SIEM Query:
source="web_logs" AND uri="/wp-admin/admin-ajax.php" AND (action="mk_file_folder_manager_shortcode" OR parameters LIKE "%backup%")