The File Manager Pro – Filester plugin for WordPress suffers from a missing capability check in the 'njt_fs_saveSettingRestrictions' function in all versions up to 1.8.2. This missing authorization allows authenticated users with roles granted permissions by an Administrator to update plugin settings controlling user role restrictions, such as enabling the upload of executable file types (.php). The vulnerability is tracked as CVE-2024-7031 and is classified under CWE-862 (Missing Authorization). It has a CVSS 3.1 base score of 7.5, indicating high severity, with network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges but high attack complexity.

An attacker with authenticated access and permissions granted by an Administrator can exploit this vulnerability to modify plugin settings, potentially allowing the upload of malicious files like PHP scripts. This can lead to full compromise of the WordPress site, including unauthorized code execution, data modification, and service disruption. The vulnerability affects all versions up to and including 1.8.2 of the plugin. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix links are provided, users should monitor the vendor's announcements for updates. In the meantime, restrict permissions carefully to trusted users only and consider disabling or removing the plugin if possible until a fix is available.