The File Manager Pro – Filester plugin in WordPress allows authenticated users with Administrator-level access to upload files without proper file type validation, raising the risk of arbitrary file uploads. Because uploaded files can be executed on the server, the flaw can lead to remote code execution. The weakness is identified as CWE-434.

Vulnerable versions are all releases up to and including 1.8.8 of ninjateam:File Manager Pro – Filester. Administrators are required to exploit the flaw, and the plugin’s permission model can extend upload privileges to lower-level users such as subscribers, expanding the attack surface.

The CVSS score is 7.2, indicating a high severity. The EPSS score of 1% shows that, while exploitation is possible, it is not among the most frequently observed vulnerabilities. The vulnerability is not currently listed in the CISA KEV catalog, suggesting no confirmed public exploits yet. Exploitation requires authenticated Administrator access and the ability to upload a crafted file, which could be achieved by an attacker who already compromises an account with sufficient privileges or through social engineering to gain such access.