CVE-2024-8066: Filester File Manager Pro RCE Vulnerability

CVE-2024-8066 Overview

CVE-2024-8066 is an arbitrary file upload vulnerability in the File Manager Pro – Filester plugin for WordPress. The flaw resides in the fsConnector function, which fails to validate uploaded file contents and destinations. Authenticated attackers with Subscriber-level access or above, when granted plugin permissions by an administrator, can upload a malicious .htaccess file. This overrides server directives and enables the subsequent upload of arbitrary files, potentially leading to remote code execution on the affected WordPress server. All versions up to and including 1.8.6 are affected. The vulnerability is classified under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
Successful exploitation allows authenticated low-privilege users to achieve remote code execution on the underlying WordPress server, resulting in full site compromise.

Affected Products

Ninjateam Filester (File Manager Pro) plugin for WordPress
All versions up to and including 1.8.6
WordPress sites where administrators have granted Filester access to Subscriber or higher roles

Discovery Timeline

2024-11-28 - CVE-2024-8066 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8066

Vulnerability Analysis

The File Manager Pro – Filester plugin exposes a file management interface through the fsConnector function. This function handles file operations initiated by authenticated users granted plugin access. The implementation does not enforce restrictions on the type or content of files uploaded through the connector. As a result, an attacker can upload a crafted .htaccess file that reconfigures Apache directives for the target directory.

Once the .htaccess file is in place, the attacker can upload files with extensions that would normally be blocked or non-executable, then coerce the server into executing them as PHP. This transforms a file upload weakness into a path to remote code execution. The vulnerability sits within the plugin's built-in permission delegation model, where administrators can extend file manager access to lower-privileged roles such as Subscribers.

Root Cause

The root cause is missing server-side validation in the fsConnector function. The function neither restricts upload of security-sensitive files such as .htaccess, nor validates file content or extension against an allowlist. Because Apache honors per-directory .htaccess directives, uploading one effectively lets the attacker rewrite handler mappings for the upload location.

Attack Vector

Exploitation requires an authenticated account with Subscriber-level access or higher, plus explicit plugin permissions granted by an administrator. The attacker authenticates to WordPress, uses the Filester interface to upload a malicious .htaccess file, and then uploads a payload file that the reconfigured web server will execute. The attack is fully remote and requires no user interaction beyond the attacker's own session.

The vulnerability mechanism is documented in the WordPress FileManager code review reference and the Wordfence vulnerability analysis.

Detection Methods for CVE-2024-8066

Indicators of Compromise

Unexpected .htaccess files inside WordPress wp-content/uploads/ or Filester-managed directories, particularly those adding AddType, AddHandler, or SetHandler directives for PHP.
Newly created PHP, PHTML, or other server-executable files in upload directories with modification times that correlate to Filester activity.
WordPress access logs showing POST requests from Subscriber-level accounts to Filester admin-ajax endpoints invoking fsConnector.
Outbound network connections from the web server to unfamiliar hosts shortly after Filester upload activity, indicating potential webshell callback.

Detection Strategies

Audit installed Filester plugin versions across WordPress environments and flag any instance at version 1.8.6 or earlier.
Monitor for HTTP requests to Filester connector endpoints that include file upload parameters referencing .htaccess or double extensions.
Correlate WordPress user role assignments with plugin permission grants to identify Subscriber accounts with elevated file manager privileges.
Enable file integrity monitoring on WordPress upload directories to detect creation of .htaccess files or unexpected executable content.

Monitoring Recommendations

Ingest WordPress and web server logs into a centralized analytics platform to hunt for Filester connector abuse patterns.
Alert on any process spawned by the PHP-FPM or Apache worker that executes shell utilities, package managers, or network tools.
Track EPSS trend data for CVE-2024-8066 to prioritize response as exploitation probability shifts.

How to Mitigate CVE-2024-8066

Immediate Actions Required

Update the File Manager Pro – Filester plugin to a version later than 1.8.6 that includes the vendor fix.
Audit which non-administrator WordPress roles have been granted Filester permissions and revoke access that is not strictly required.
Review WordPress upload directories for unauthorized .htaccess files or unexpected executable content and remove them.
Rotate credentials for any Subscriber-level or higher account that had Filester access during the exposure window.

Patch Information

The vendor addressed the arbitrary file upload issue in the Filester plugin. Details of the code change are available in the WordPress plugin changeset 3186518. Administrators should update through the WordPress plugin manager or by replacing plugin files with a fixed release, then verify the installed version reflects the patched build.

Workarounds

Deactivate and remove the Filester plugin until the patched version has been installed and validated.
Restrict Filester access to Administrator accounts only, removing plugin permissions from Subscribers, Contributors, Authors, and Editors.
Configure the web server to ignore .htaccess overrides in WordPress upload directories by setting AllowOverride None for those paths.
Deploy a web application firewall rule that blocks uploads of .htaccess files and files with executable extensions to Filester endpoints.

bash

# Apache configuration example: disable .htaccess overrides in WordPress uploads
<Directory "/var/www/html/wp-content/uploads">
    AllowOverride None
    <FilesMatch "\.(php|phtml|phar|php7|php8)$">
        Require all denied
    </FilesMatch>
</Directory>