CVE-2023-5907

File Manager < 6.3 - Admin+ Arbitrary OS File/Folder Access + Path Traversal

The File Manager WordPress plugin before 6.3 does not restrict the file managers root directory, allowing an administrator to set a root outside of the WordPress root directory, giving access to system files and directories even in a multisite setup, where site administrators should not be allowed to modify the sites files.

Affected

File Manager

CVSS v3.1 NVD

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

EPSS

0.85% chance of exploitation in the next 30 days, 57th percentile

Published

2023-12-11

Updated

2025-05-27

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/f250226f-4a05-4d75-93c4-5444a4ce919e

References

• CVE Record
• NVD entry