File Manager Pro – Filester <= 2.1.4 - Authenticated (Subscriber+) Arbitrary File Upload via File Manager Upload MIME Restrictions
- ID
- WPSEC-2026-1783
- Plugin
- File Manager Pro – Filester (filester)
- Affected
- all versions before 2.1.5
- Remediation
- Update to 2.1.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-434
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-27
- Attack surface
- File Manager Pro – Filester on WPSec AttackSurface
- Fix released
- Published
Description
The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file upload via the file manager connector (fs_connector AJAX action) in all versions up to, and including, 2.1.4, due to the per-role allowed upload MIME list not being re-checked against the plugin's deny list at runtime, and the deny list not blocking whole MIME groups such as 'text' and 'application', which elFinder treats as allowing every subtype. This makes it possible for authenticated attackers, with Subscriber-level access and above, whose role has been granted file manager access with an allowed-type list containing such a group, to upload, create or rename files as PHP scripts, which can lead to remote code execution.
References
- https://wpsec.com/vuln/WPSEC-2026-1783/
- https://plugins.svn.wordpress.org/filester/tags/2.1.5/
- https://wordpress.org/plugins/filester/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS