CVE-2024-7031

CVSS V2 None CVSS V3 None

Description

The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'njt_fs_saveSettingRestrictions' function in all versions up to, and including, 1.8.2. This makes it possible for authenticated attackers, with a role that has been granted permissions by an Administrator, to update the plugin settings for user role restrictions, including allowing file types such as .php to be uploaded.

Overview

CVE ID
CVE-2024-7031

Assigner
Wordfence

Vulnerability Status
PUBLISHED

Published Version
2024-08-03T08:36:57.626Z

Last Modified Date
2024-08-03T08:36:57.626Z

Weakness Enumerations

CWE	URL
CWE-862	http://cwe.mitre.org/data/definitions/862.html

References

Reference URL	Reference Tags
https://www.wordfence.com/threat-intel/vulnerabilities/id/aef584bd-60a5-4bf2-b8d3-58e3b45e785e?source=cve
https://plugins.trac.wordpress.org/browser/filester/trunk/includes/File_manager/FileManager.php#L566
https://plugins.trac.wordpress.org/changeset/3129722/

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-7031
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7031

History

Created	Old Value	New Value	Data Type	Notes
2024-08-04 13:02:37				Added to TrackCVE