{
 "id": "WPSEC-2026-1783",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1783/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1783/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1783/index.md",
 "title": "File Manager Pro – Filester <= 2.1.4 - Authenticated (Subscriber+) Arbitrary File Upload via File Manager Upload MIME Restrictions",
 "description": "The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file upload via the file manager connector (fs_connector AJAX action) in all versions up to, and including, 2.1.4, due to the per-role allowed upload MIME list not being re-checked against the plugin's deny list at runtime, and the deny list not blocking whole MIME groups such as 'text' and 'application', which elFinder treats as allowing every subtype. This makes it possible for authenticated attackers, with Subscriber-level access and above, whose role has been granted file manager access with an allowed-type list containing such a group, to upload, create or rename files as PHP scripts, which can lead to remote code execution.",
 "plugin": {
  "slug": "filester",
  "name": "File Manager Pro – Filester",
  "full_name": "File Manager Pro – Filester",
  "wordpress_org": "https://wordpress.org/plugins/filester/",
  "advisories_url": "https://wpsec.com/vuln/plugin/filester/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/filester"
 },
 "type": "UPLOAD",
 "cwe": [
  "CWE-434"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.5,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.1.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.1.5"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.1.5",
 "remediation": "Update to 2.1.5 or later.",
 "fix_released": "2026-10-26T21:38:21+00:00",
 "published": "2026-10-27T21:48:09+00:00",
 "updated": "2026-10-27T13:39:48.299700+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1783/",
  "https://plugins.svn.wordpress.org/filester/tags/2.1.5/",
  "https://wordpress.org/plugins/filester/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/filester",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-27"
 }
}