{
 "id": "WPSEC-2026-1785",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1785/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1785/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1785/index.md",
 "title": "File Manager Pro – Filester <= 2.1.4 - Authenticated (Administrator+) Arbitrary File Upload via File Manager Settings on Multisite",
 "description": "The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file upload via the file manager settings and connector in all versions up to, and including, 2.1.4, due to the njt_fs_save_setting and njt_fs_save_setting_restrictions AJAX actions requiring only the manage_options capability on multisite, and the connector not restricting executable file extensions for users who are not super admins. This makes it possible for authenticated attackers, with site Administrator-level access on a multisite network where administrators have been granted file manager access, to change their own upload restrictions and root folder or to create or rename PHP files on the server, which can lead to remote code execution.",
 "plugin": {
  "slug": "filester",
  "name": "File Manager Pro – Filester",
  "full_name": "File Manager Pro – Filester",
  "wordpress_org": "https://wordpress.org/plugins/filester/",
  "advisories_url": "https://wpsec.com/vuln/plugin/filester/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/filester"
 },
 "type": "UPLOAD",
 "cwe": [
  "CWE-434"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.6,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.1.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.1.5"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.1.5",
 "remediation": "Update to 2.1.5 or later.",
 "fix_released": "2026-10-26T21:38:21+00:00",
 "published": "2026-10-27T21:48:09+00:00",
 "updated": "2026-10-27T13:39:48.299700+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1785/",
  "https://plugins.svn.wordpress.org/filester/tags/2.1.5/",
  "https://wordpress.org/plugins/filester/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/filester",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-27"
 }
}