CVE-2024-1538 is a high-severity CSRF vulnerability in the mndpsingh287 File Manager WordPress plugin affecting all versions up to 7.2.4. The issue arises from missing or incorrect nonce validation on the wp_file_manager page, which processes the 'lang' parameter to include files. This flaw enables unauthenticated attackers to include local JavaScript files, which can be exploited to achieve remote code execution if an administrator is tricked into clicking a malicious link. The vulnerability was partially addressed in version 7.2.4 and fully resolved in version 7.2.5.

Successful exploitation can lead to remote code execution with high impact on confidentiality, integrity, and availability of the affected WordPress site. Attackers do not require authentication but rely on social engineering to trick administrators into triggering the malicious request. This can result in full compromise of the site.

Upgrade the File Manager plugin to version 7.2.5 or later, where the vulnerability is fully patched. Versions up to and including 7.2.4 are vulnerable, with only a partial fix applied in 7.2.4. No other mitigations are indicated by the vendor advisory.