The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the 'class_fma_connector.php' file in all versions up to, and including, 5.2.10. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an Administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://plugins.trac.wordpress.org/changeset/3199242/ | Patch |
| https://www.wordfence.com/threat-intel/vulnerabilities/id/f14a658c-1517-4af4-8bd7-c379ac07ab35?source=cve | Third Party Advisory |
Configurations
History
05 Jun 2025, 15:49
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://plugins.trac.wordpress.org/changeset/3199242/ - Patch | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/f14a658c-1517-4af4-8bd7-c379ac07ab35?source=cve - Third Party Advisory | |
| CPE | cpe:2.3:a:advancedfilemanager:advanced_file_manager:*:*:*:*:*:wordpress:*:* | |
| First Time |
Advancedfilemanager advanced File Manager
Advancedfilemanager |
03 Dec 2024, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-12-03 15:15
Updated : 2025-06-05 15:49
NVD link : CVE-2024-11391
Mitre link : CVE-2024-11391
JSON object : View
Products Affected
advancedfilemanager
- advanced_file_manager
CWE
No CWE.