7.5
High
CVE-2024-11391 The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type…
Description
The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the 'class_fma_connector.php' file in all versions up to, and including, 5.2.10. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an Administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Advanced File Manager 5.2 | earliest → 5.2.10 | No fix stated |
| advanced_file_manager 5.2 | earliest → 5.2.10 | No fix stated |
| Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution 5.2 | earliest → 5.2.10 | No fix stated |
Other CVEs of Advanced File Manager
The 5 CVEs of Advanced File Manager →
CVE-2024-8725
Multiple plugins and/or themes for WordPress are vulnerable to Limited File Upload in various versions
6.8
Medium
CVE-2024-8126
The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads via the 'class_fma_connector.php'…
7.5
High
CVE-2024-8704
The Advanced File Manager plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to,…
7.2
High
CVE-2024-5598
The Advanced File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to,…
7.5
High