CVE-2024-8066 is a vulnerability classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) found in the File Manager Pro – Filester plugin for WordPress. The flaw exists in the 'fsConnector' function, which lacks proper validation of uploaded files. This allows authenticated attackers with at least Subscriber-level access, who have been granted upload permissions by an Administrator, to upload arbitrary files, including .htaccess files. By uploading a crafted .htaccess file, attackers can modify server behavior to permit further arbitrary file uploads, potentially leading to remote code execution (RCE). The vulnerability affects all versions up to and including 1.8.6. The CVSS v3.1 base score is 7.5, indicating high severity, with attack vector being network-based, requiring low privileges but high attack complexity, and no user interaction. The vulnerability compromises confidentiality, integrity, and availability of the affected WordPress sites. While no public exploits are known yet, the potential for exploitation is significant due to the plugin's popularity and the common use of WordPress for hosting websites. The lack of patch links suggests that a fix may not yet be publicly available, emphasizing the need for immediate mitigation by administrators.

The vulnerability allows attackers to upload arbitrary files, including malicious scripts, which can lead to remote code execution on the web server. This compromises the confidentiality of sensitive data stored on the site, the integrity of website content, and the availability of the service if the attacker disrupts normal operations. Attackers could use this access to pivot within the network, deploy malware, deface websites, steal user data, or launch further attacks. Since the exploit requires only low-level authenticated access, attackers could leverage compromised or weak subscriber accounts to escalate privileges. The widespread use of WordPress and this plugin means a large number of websites globally could be affected, including corporate, governmental, and personal sites, potentially leading to significant reputational and financial damage.

Administrators should immediately review and restrict permissions granted to Subscriber-level users and ensure that only trusted users have upload capabilities. Until an official patch is released, consider disabling or uninstalling the File Manager Pro – Filester plugin if feasible. Implement web application firewalls (WAFs) with rules to block suspicious file uploads, especially .htaccess files. Monitor server logs for unusual upload activity or changes to .htaccess files. Employ strict file type validation and sanitization on uploads at the server level as an additional safeguard. Regularly audit user roles and permissions to minimize the risk of privilege abuse. Keep WordPress core and all plugins updated and subscribe to vendor security advisories for timely patching once available. Consider isolating the WordPress environment using containerization or sandboxing to limit potential damage from exploitation.