CVE-2024-12331 affects the File Manager Pro – Filester WordPress plugin by lacking a capability check in the 'ajax_install_plugin' function. This missing authorization allows authenticated users with low privileges (Subscriber and above) to install additional plugins, specifically the Filebird plugin, potentially leading to unauthorized modification of the WordPress environment. The vulnerability impacts all versions up to and including 1.8.6. The CVSS score of 4.3 reflects a medium severity with network attack vector, low attack complexity, and privileges required at the level of an authenticated user. No patch or official fix has been documented in the provided data.

An attacker with at least Subscriber-level access can exploit this vulnerability to install the Filebird plugin without proper authorization. This unauthorized plugin installation could lead to further unauthorized modifications or privilege escalations depending on the installed plugin's capabilities. However, the vulnerability does not directly impact confidentiality or availability, as indicated by the CVSS vector (no confidentiality or availability impact, limited integrity impact). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for unauthorized plugin installations. Avoid granting Subscriber-level or higher access to untrusted users. Follow updates from the plugin vendor or WordPress security advisories for any forthcoming patches.