CVE-2024-8066 is a vulnerability in the File Manager Pro – Filester WordPress plugin caused by improper validation of uploaded files in the 'fsConnector' function. Authenticated attackers with Subscriber-level access and permissions granted by an Administrator can upload .htaccess files, which may then be used to upload arbitrary files to the server. This can potentially lead to remote code execution. The vulnerability affects all versions up to and including 1.8.6. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges but high attack complexity.

Successful exploitation allows an authenticated user with limited privileges but granted upload permissions to upload malicious files, including .htaccess, enabling further arbitrary file uploads and potentially remote code execution. This compromises the confidentiality, integrity, and availability of the affected WordPress site and its server environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict upload permissions strictly and review user roles and permissions to prevent unauthorized file uploads. Monitor for suspicious file uploads and consider disabling or replacing the plugin if possible.