Critical severity · published Oct 16, 2024
CVE-2018-25105
File Manager <= 3.0 - Unauthenticated Arbitrary File Upload/Download
9.8
CVSS
0.8%
EPSS
No
On KEV
Description
The File Manager plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the /inc/root.php file in versions up to, and including, 3.0. This makes it possible for unauthenticated attackers to download arbitrary files from the server and upload arbitrary files that can be used for remote code execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FM
File Manager · mndpsingh287
through 3.0 · source: vendor, NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-25105
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-25105
Patch
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=1942390%40wp-file-manager&new=1942390%40wp-file-manager&sfp_email=&sfph_mail=
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/a56d5a2f-ae13-4523-bc4a-17bb2fb4c6f0?source=cve
More from File Manager
9.9
CVE-2023-6825
File Manager And File Manager Pro (Multiple Versions) - Directory Traversal
8.8
CVE-2024-1538
File Manager <= 7.2.4 - Cross-Site Request Forgery to Local JS File Inclusion
7.5
CVE-2024-0761
File Manager <= 7.2.1 - Sensitive Information Exposure via Backup Filenames
6.8
CVE-2024-2654
File Manager <= 7.2.5 - Authenticated (Administrator+) Directory Traversal
4.3
CVE-2024-37254
WordPress WP File Manager plugin <= 7.2.7 - Broken Access Control vulnerability