CVEvulnerability

CVE-2018-25105

9.8 CRITICAL Published 2024-10-16 Modified 2026-06-17 Official page ↗

Status: Analyzed
Published: 2024-10-16
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-862

Description

The File Manager plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the /inc/root.php file in versions up to, and including, 3.0. This makes it possible for unauthenticated attackers to download arbitrary files from the server and upload arbitrary files that can be used for remote code execution.

Affected configurations

• filemanagerpro file manager (<= 3.0)

Weakness · CWE (1)

CWE-862 Missing Authorization weakness

References

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=1942390%40wp-file-manager&new=1942390%40wp-file-manager&sfp_email=&sfph_mail= Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/a56d5a2f-ae13-4523-bc4a-17bb2fb4c6f0?source=cve Third Party Advisory

CVE-2018-25105

Description

Affected configurations

Related

Weakness · CWE (1)

References