CVE-2024-8126: Advanced File Manager WordPress RCE Flaw

CVE-2024-8126 Overview

CVE-2024-8126 is an arbitrary file upload vulnerability in the Advanced File Manager plugin for WordPress. The flaw resides in the class_fma_connector.php file and affects all versions up to and including 5.2.8. Authenticated users with Subscriber-level access, provided an administrator has granted them plugin permissions, can upload a malicious .htaccess file. This upload enables subsequent arbitrary file uploads to the affected server, which may lead to remote code execution. The weakness is categorized under [CWE-434: Unrestricted Upload of File with Dangerous Type].

Critical Impact
Authenticated attackers can upload arbitrary files and potentially achieve remote code execution on the underlying WordPress server.

Affected Products

Advanced File Manager plugin for WordPress, versions up to and including 5.2.8
WordPress sites where the plugin is installed and low-privileged users have been granted file manager permissions
All hosting environments running vulnerable plugin builds regardless of platform

Discovery Timeline

2024-09-26 - CVE-2024-8126 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8126

Vulnerability Analysis

The Advanced File Manager plugin exposes file operations through the class_fma_connector.php handler. The connector fails to restrict which file types authenticated users can upload when they have been granted plugin access by an administrator. Attackers abuse this gap to place a .htaccess file into the plugin's storage directory. A crafted .htaccess can redefine how the web server interprets subsequent uploads, for example by enabling PHP execution in a directory that would otherwise treat files as static content.

Once the attacker controls Apache directives inside the target directory, follow-on uploads of PHP payloads execute in the WordPress process context. This chain converts an ordinary Subscriber account into a foothold for full site compromise, including credential theft, database access, and pivoting into the hosting environment.

Root Cause

The root cause is missing validation of file extensions and MIME types on upload requests handled by class_fma_connector.php. The plugin permits writing .htaccess files into web-accessible paths without denying reserved server configuration filenames. This is a classic instance of [CWE-434] where the file type allowlist is incomplete.

Attack Vector

Exploitation requires network access to the WordPress site and an authenticated account at Subscriber level or higher. The administrator must have granted that account permissions inside the Advanced File Manager plugin. The attacker submits an upload request through the plugin's connector endpoint containing a .htaccess file, then uploads a secondary PHP payload and requests it over HTTP to trigger execution. No user interaction is needed beyond the attacker's own authenticated session. Full technical detail is available in the Wordfence Vulnerability Report and the vulnerable source in the WordPress File Manager Code.

Detection Methods for CVE-2024-8126

Indicators of Compromise

Presence of a newly created or modified .htaccess file inside plugin-managed upload directories such as wp-content/uploads/ subfolders controlled by Advanced File Manager
Unexpected .php, .phtml, or .phar files in directories otherwise reserved for user documents or media
WordPress access logs showing Subscriber-level accounts issuing POST requests to Advanced File Manager connector endpoints followed by GET requests to newly created files
New administrator accounts, modified theme or plugin files, or outbound connections initiated by the PHP worker after suspicious uploads

Detection Strategies

Monitor filesystem writes to WordPress upload directories for .htaccess filenames and for executable script extensions
Alert on HTTP requests to plugin routes such as those handled by class_fma_connector.php originating from non-administrator sessions
Correlate WordPress user role assignments with subsequent file upload activity to catch abuse of granted plugin permissions

Monitoring Recommendations

Enable Apache or Nginx access logging with full request URIs and forward logs to a centralized platform for retention and search
Track integrity of .htaccess files across the document root using file integrity monitoring
Review Advanced File Manager permission grants regularly and alert on privilege changes for low-tier WordPress roles

How to Mitigate CVE-2024-8126

Immediate Actions Required

Update the Advanced File Manager plugin to a version later than 5.2.8 as published in WordPress Changeset #3157713
Revoke Advanced File Manager permissions from all non-administrator WordPress accounts until the patch is applied
Audit the plugin's upload directories for unauthorized .htaccess files and unexpected PHP scripts, and remove any that are present
Rotate WordPress administrator credentials and secret keys if compromise is suspected

Patch Information

The vendor addressed the issue in WordPress Changeset #3157713. Site operators should upgrade the plugin through the WordPress admin dashboard or by replacing the plugin directory with the fixed release. Verify the installed version after the update in Plugins → Installed Plugins.

Workarounds

Deactivate the Advanced File Manager plugin until the update can be applied
Configure the web server to deny execution of PHP inside upload directories at the server or virtual host level so that per-directory .htaccess cannot re-enable it
Restrict WordPress registration and remove Subscriber-level accounts that are not required for site operation

bash

# Nginx: block PHP execution and .htaccess service inside WordPress uploads
location ^~ /wp-content/uploads/ {
    location ~* \.(php|phtml|phar)$ { return 403; }
    location ~* /\.ht                { return 403; }
}