CVE-2024-13333: WordPress File Manager RCE Vulnerability

CVE-2024-13333 Overview

CVE-2024-13333 affects the Advanced File Manager plugin for WordPress in versions 5.2.12 to 5.2.13. The vulnerability stems from missing file type validation in the fma_local_file_system function. Authenticated attackers with Subscriber-level access or above, combined with upload permissions granted by an administrator, can upload arbitrary files to the affected site. Successful exploitation can lead to remote code execution on the underlying web server. The flaw is only exploitable when the Display .htaccess? setting is enabled, which raises the attack complexity but does not eliminate risk on sites configured this way.

Critical Impact
Authenticated attackers can upload arbitrary files, including PHP scripts, that lead to remote code execution on the WordPress host.

Affected Products

Advanced File Manager plugin for WordPress version 5.2.12
Advanced File Manager plugin for WordPress version 5.2.13
WordPress installations with the Display .htaccess? setting enabled

Discovery Timeline

2025-01-17 - CVE-2024-13333 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-13333

Vulnerability Analysis

The vulnerability is classified as an unrestricted file upload issue [CWE-434]. The fma_local_file_system function in class_fma_connector.php accepts uploaded files without validating the file type or extension against a deny list of executable server-side scripts. When the Display .htaccess? option is enabled, the connector exposes file operations that permit writing arbitrary content, including PHP files, into web-accessible directories. Once written, the attacker requests the uploaded file through the web server, which executes it in the PHP context of the WordPress site. This yields code execution under the web server user, exposing the database, wp-config secrets, and adjacent tenants on shared hosting.

Root Cause

The root cause is missing server-side validation of user-supplied file uploads within the plugin's local file system handler. The plugin relies on client-side or configuration-gated checks rather than enforcing an allowlist of safe MIME types and extensions before writing files to disk. See the WordPress File Manager Code for the pre-patch implementation.

Attack Vector

An authenticated attacker with at least Subscriber privileges and administrator-granted upload permissions issues a file upload request through the plugin's connector endpoint. The attacker supplies a PHP payload with an executable extension. Because the fma_local_file_system function does not validate the file type, the payload is written to a web-accessible path. The attacker then requests the file via HTTP, triggering execution. Detailed exploit conditions are documented in the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2024-13333

Indicators of Compromise

Newly created .php, .phtml, or .phar files under the WordPress wp-content/uploads directory or plugin-managed folders
Outbound HTTP or DNS requests initiated by the PHP-FPM or Apache process to unfamiliar hosts following file upload activity
New administrator accounts, modified WordPress options, or unexpected scheduled tasks (wp-cron entries) after upload events
Web server access logs showing POST requests to admin-ajax.php with fma_ action parameters followed by GETs to newly created files

Detection Strategies

Inventory WordPress instances running Advanced File Manager and confirm the installed version against 5.2.12 and 5.2.13
Audit the plugin's role and permission settings, focusing on which non-administrator roles have upload capability and whether Display .htaccess? is enabled
Correlate authenticated session activity with file system writes to uploads directories using file integrity monitoring

Monitoring Recommendations

Enable web application firewall rules that block uploads of executable server-side extensions to WordPress endpoints
Forward WordPress, PHP, and web server logs to a centralized platform and alert on execution of files written within the last 24 hours
Monitor for suspicious child processes spawned by the web server user, such as shells or outbound network utilities

How to Mitigate CVE-2024-13333

Immediate Actions Required

Update the Advanced File Manager plugin to a version later than 5.2.13 that includes the fix committed in WordPress Changeset #3222740
Disable the Display .htaccess? setting until the plugin is patched, which removes the exploitation precondition
Review and revoke upload permissions granted to Subscriber, Contributor, and other low-privilege roles
Audit the uploads directory for unexpected executable files and remove any confirmed web shells

Patch Information

The vendor addressed the issue in the commit tracked as WordPress Changeset #3222740. Site administrators should update to the latest release of Advanced File Manager available through the WordPress plugin repository. Verify the running version through the WordPress admin plugin list after the update completes.

Workarounds

Disable the Display .htaccess? option in the plugin configuration to block the exploitation path
Deny PHP execution within wp-content/uploads using web server configuration, for example an Apache <FilesMatch> block or an Nginx location directive that returns 403 for .php files
Restrict plugin upload capabilities to trusted administrator accounts only
Deploy a WordPress-aware web application firewall with rules covering CVE-2024-13333

bash

# Apache: block PHP execution inside the WordPress uploads directory
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|phar|php7|php8)$">
        Require all denied
    </FilesMatch>
</Directory>