CVE-2024-1538 Overview
CVE-2024-1538 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the File Manager plugin for WordPress in all versions up to and including 7.2.4. The flaw stems from missing or incorrect nonce validation on the wp_file_manager page, which includes files via the lang parameter. Unauthenticated attackers can include local JavaScript files and chain the behavior to achieve Remote Code Execution (RCE) if a site administrator is tricked into clicking a crafted link. The vendor partially patched the issue in version 7.2.4 and fully resolved it in version 7.2.5.
Critical Impact
A successful exploit grants attackers code execution on the affected WordPress server, enabling full site compromise.
Affected Products
- Filemanagerpro File Manager plugin for WordPress versions up to and including 7.2.4
- WordPress installations with the free File Manager plugin enabled
- Sites where administrators can be social-engineered into clicking attacker-supplied links
Discovery Timeline
- 2024-03-21 - CVE-2024-1538 published to NVD
- 2026-04-08 - Last updated in NVD database
Technical Details for CVE-2024-1538
Vulnerability Analysis
The File Manager plugin exposes the wp_file_manager administrative page, which dynamically includes language files based on the lang GET parameter. Vulnerable versions fail to validate a WordPress nonce on this request, leaving the action open to forgery. An attacker hosts a malicious page or link that issues a state-changing request to the WordPress site while the targeted administrator is authenticated.
Because the included file path is influenced by the lang parameter, an attacker can point the include to a local JavaScript file. The plugin then loads attacker-controlled or attacker-chosen content within the administrator's authenticated session, providing a path to execute arbitrary code through the file manager's own privileged file operations.
The weakness is classified as [CWE-352] Cross-Site Request Forgery. The EPSS score is 10.651%, placing the vulnerability in the 95th percentile of likelihood of exploitation.
Root Cause
The root cause is the absence of correct nonce validation on the wp_file_manager administrative page. WordPress nonces exist precisely to bind sensitive actions to a user session and prevent forged requests, and the plugin omitted that check on the lang parameter handler.
Attack Vector
Exploitation is network-based and requires user interaction. The attacker must convince a logged-in WordPress administrator to visit a malicious page or click a crafted link. Once triggered, the browser sends the forged request to wp_file_manager with an attacker-controlled lang value, causing the plugin to include the targeted local JavaScript file under administrator privileges and pivot to RCE through file manager functionality.
No verified public exploit code is available. The vulnerability mechanism is documented in the Wordfence Vulnerability Report.
Detection Methods for CVE-2024-1538
Indicators of Compromise
- Unexpected requests to wp-admin/admin.php?page=wp_file_manager containing a lang parameter referencing non-standard paths
- New, modified, or unfamiliar PHP files in plugin, theme, or upload directories following administrator browsing activity
- Outbound connections from the web server to unknown hosts shortly after administrator sessions
Detection Strategies
- Inspect web server and WordPress access logs for wp_file_manager requests with suspicious lang values, especially those referencing paths outside the plugin's language directory
- Correlate administrator authenticated sessions with Referer headers pointing to external, untrusted domains
- Monitor for File Manager plugin actions executed immediately after a page load that lacks a valid nonce in the request
Monitoring Recommendations
- Enable file integrity monitoring on wp-content/plugins/wp-file-manager/ and the WordPress core directories
- Alert on PHP process spawning shell utilities such as sh, bash, python, or wget from the web server account
- Forward WordPress and web server logs to a centralized analytics platform for correlation across administrator activity and file system changes
How to Mitigate CVE-2024-1538
Immediate Actions Required
- Upgrade the File Manager plugin to version 7.2.5 or later on every WordPress site in scope
- Audit administrator accounts and rotate credentials if any administrator interacted with untrusted links during the exposure window
- Review recent file changes in wp-content/ and remove any unauthorized PHP or JavaScript artifacts
Patch Information
The vendor partially fixed the vulnerability in version 7.2.4 and fully patched it in version 7.2.5. The corresponding source change is published in the WordPress Plugin Changeset. Administrators should confirm the installed version reports 7.2.5 or higher.
Workarounds
- Deactivate and remove the File Manager plugin until the upgrade to 7.2.5 is completed
- Restrict access to wp-admin by IP allowlist at the web server or WAF layer to reduce CSRF exposure
- Require administrators to use isolated browser profiles for WordPress administration to limit cross-site request risk
# Verify the installed File Manager plugin version via WP-CLI
wp plugin get wp-file-manager --field=version
# Update the plugin to the patched release
wp plugin update wp-file-manager --version=7.2.5
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
