File Manager Pro – Filester <= 2.1.4 - Authenticated (Administrator+) Arbitrary File Upload via File Manager Settings on Multisite
- ID
- WPSEC-2026-1785
- Plugin
- File Manager Pro – Filester (filester)
- Affected
- all versions before 2.1.5
- Remediation
- Update to 2.1.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-434
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-27
- Attack surface
- File Manager Pro – Filester on WPSec AttackSurface
- Fix released
- Published
Description
The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file upload via the file manager settings and connector in all versions up to, and including, 2.1.4, due to the njt_fs_save_setting and njt_fs_save_setting_restrictions AJAX actions requiring only the manage_options capability on multisite, and the connector not restricting executable file extensions for users who are not super admins. This makes it possible for authenticated attackers, with site Administrator-level access on a multisite network where administrators have been granted file manager access, to change their own upload restrictions and root folder or to create or rename PHP files on the server, which can lead to remote code execution.
References
- https://wpsec.com/vuln/WPSEC-2026-1785/
- https://plugins.svn.wordpress.org/filester/tags/2.1.5/
- https://wordpress.org/plugins/filester/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS