CVE-2024-8746: File Manager Pro WordPress RCE Vulnerability

CVE-2024-8746 Overview

CVE-2024-8746 affects the File Manager Pro plugin for WordPress in all versions up to and including 8.3.9. The vulnerability stems from missing file type validation in the mk_file_folder_manager_shortcode AJAX action. Attackers granted File Manager access by an administrator can download and upload arbitrary backup files to the affected site's server. Successful exploitation can lead to remote code execution on the underlying host. The flaw is categorized as an unrestricted file upload weakness [CWE-434].

Critical Impact
Attackers with File Manager access can upload arbitrary backup files, potentially achieving remote code execution on the WordPress server.

Affected Products

File Manager Pro for WordPress versions up to and including 8.3.9
WordPress sites running the filemanagerpro:file_manager plugin
Any site where administrators have granted File Manager access to additional roles

Discovery Timeline

2024-10-16 - CVE-2024-8746 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8746

Vulnerability Analysis

The File Manager Pro plugin exposes the mk_file_folder_manager_shortcode AJAX endpoint to handle file operations within the WordPress dashboard. The handler processes upload and download requests for backup files but fails to validate file types or extensions against an allowlist. This omission allows attackers to submit files containing executable PHP payloads disguised as backups. Once written to a web-accessible directory, the attacker requests the uploaded file directly to trigger code execution.

The attack requires user interaction, reflected in the CVSS vector by UI:R, because an administrator must first grant File Manager access to the attacker's role. After access is granted, the endpoint accepts requests without enforcing authentication on the file type check itself.

Root Cause

The root cause is missing input validation in the file upload and download routines of the mk_file_folder_manager_shortcode handler. The plugin trusts client-supplied file metadata and does not verify MIME types, magic bytes, or extensions before writing files to disk. This violates the secure design principle of validating untrusted input at trust boundaries, as documented in CWE-434: Unrestricted Upload of File with Dangerous Type.

Attack Vector

The attack proceeds over the network against the WordPress AJAX interface. An attacker with File Manager access submits a crafted POST request to admin-ajax.php invoking the mk_file_folder_manager_shortcode action with a backup file payload. The payload contains PHP code with an extension or content type designed to bypass weak filtering. After upload, the attacker navigates to the file path and triggers server-side execution. The EPSS score is 0.594% with a percentile of 43.759, indicating moderate but non-trivial probability of exploitation activity.

For technical details, see the Wordfence Vulnerability Report and the File Manager Pro Overview.

Detection Methods for CVE-2024-8746

Indicators of Compromise

POST requests to wp-admin/admin-ajax.php containing the action=mk_file_folder_manager_shortcode parameter from non-administrative users
New or modified files with executable extensions such as .php, .phtml, or .phar inside WordPress upload or backup directories
Unexpected outbound network connections originating from the PHP-FPM or web server process after a file upload event
Backup archives containing PHP source files placed in web-accessible paths

Detection Strategies

Monitor web server access logs for AJAX calls referencing the vulnerable action handler, especially from authenticated low-privilege accounts
Compare file integrity baselines across wp-content/uploads and any custom File Manager directories to flag new executable content
Inspect HTTP request bodies for multipart uploads where the declared content type mismatches the file extension or magic bytes
Correlate plugin version inventory data with the affected range to identify exposed WordPress installations

Monitoring Recommendations

Enable verbose logging on admin-ajax.php and forward logs to a centralized SIEM for retention and analysis
Alert on creation of .php files outside expected plugin and theme directories
Track administrative actions that grant File Manager access to non-admin roles and review these changes regularly

How to Mitigate CVE-2024-8746

Immediate Actions Required

Update File Manager Pro to a release after 8.3.9 that addresses the missing file type validation
Audit which WordPress roles have been granted File Manager access and revoke unnecessary permissions
Review the WordPress upload and backup directories for unexpected files and remove any unauthorized payloads
Rotate WordPress administrative credentials and API keys if unauthorized uploads are confirmed

Patch Information

Review the Wordfence Vulnerability Report for the fixed version and remediation guidance. Confirm the installed plugin version through the WordPress admin Plugins page and apply the vendor update across all affected sites.

Workarounds

Restrict File Manager access exclusively to trusted administrator accounts until patching is complete
Deploy a web application firewall rule that blocks requests to the mk_file_folder_manager_shortcode AJAX action from non-administrator sessions
Configure the web server to deny PHP execution within WordPress upload and backup directories using directory-level handler restrictions
Disable the plugin entirely if business operations do not require it

bash

# Apache: deny PHP execution in WordPress uploads directory
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|phar)$">
        Require all denied
    </FilesMatch>
</Directory>