File Manager
Approved changes feed: RSS · Atom
cpe:2.3:a:filemanagerpro:file_manager:*:*:*:*:free:wordpress:*:*
part: a version: * update: *
| Vendor | Filemanagerpro (bb02e783-0911-54b7-968e-635005d3120a) |
|---|---|
| Product | File Manager (1e151410-48c9-590e-aae5-aae36b786a62) |
| Edition | * |
| Language | * |
| Software edition | free |
| Target software | wordpress |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-2654 |
vulnerable | 2026-06-08 06:33:31.729655 |
File Manager <= 7.2.5 - Authenticated (Administrator+) Directory Traversal
MEDIUM (6.8)
The File Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.2.5 via the fm_download_backup function. This makes it possible for authenticated attackers, with administrator access and above, to read the contents of arbitrary zip files on the server, which can contain sensitive information.
Published: 2024-04-09T18:59:21.868Z
Updated: 2026-04-08T17:23:19.350Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-1538 |
vulnerable | 2026-06-08 06:27:13.312909 |
File Manager <= 7.2.4 - Cross-Site Request Forgery to Local JS File Inclusion
HIGH (8.8)
The File Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.4. This is due to missing or incorrect nonce validation on the wp_file_manager page that includes files through the 'lang' parameter. This makes it possible for unauthenticated attackers to include local JavaScript files that can be leveraged to achieve RCE via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This issue was partially patched in version 7.2.4, and fully patched in 7.2.5.
Published: 2024-03-21T03:32:42.789Z
Updated: 2026-04-08T16:54:28.341Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-25213 |
vulnerable | 2026-06-08 05:22:36.447801 |
Details available
CRITICAL (10)
The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. This was exploited in the wild in August and September 2020.
Published: 2020-09-09T00:00:00.000Z
Updated: 2025-10-21T23:35:36.713Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.