# File Manager Pro – Filester <= 2.1.4 - Authenticated (Subscriber+) Arbitrary File Upload via File Manager Upload MIME Restrictions

- **ID:** WPSEC-2026-1783
- **Plugin:** File Manager Pro – Filester (`filester`), https://wordpress.org/plugins/filester/
- **Affected versions:** all versions before 2.1.5
- **Fixed in:** 2.1.5 (Update to 2.1.5 or later.)
- **Severity:** High 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-434
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/filester
- **Fix released:** 2026-10-26
- **Published:** 2026-10-27
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1783/

## Description

The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file upload via the file manager connector (fs_connector AJAX action) in all versions up to, and including, 2.1.4, due to the per-role allowed upload MIME list not being re-checked against the plugin's deny list at runtime, and the deny list not blocking whole MIME groups such as 'text' and 'application', which elFinder treats as allowing every subtype. This makes it possible for authenticated attackers, with Subscriber-level access and above, whose role has been granted file manager access with an allowed-type list containing such a group, to upload, create or rename files as PHP scripts, which can lead to remote code execution.

## References

- https://wpsec.com/vuln/WPSEC-2026-1783/
- https://plugins.svn.wordpress.org/filester/tags/2.1.5/
- https://wordpress.org/plugins/filester/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1783/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.