The File Manager Pro plugin for WordPress contains a CSRF vulnerability (CWE-352) due to improper nonce validation on the 'mk_file_folder_manager' AJAX action. This allows attackers to craft forged requests that, if executed by an authenticated administrator, can result in arbitrary file uploads. The vulnerability affects all versions up to 8.3.9 and has a CVSS 3.1 base score of 8.8, reflecting network attack vector, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability. No patch or official fix details are currently available from the vendor or advisory sources.

Successful exploitation can lead to arbitrary file uploads by unauthenticated attackers, potentially compromising the confidentiality, integrity, and availability of the affected WordPress site. This could enable further attacks such as remote code execution or site defacement if malicious files are uploaded and executed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on suspicious links and consider restricting access to the File Manager Pro plugin or disabling it temporarily. Monitoring for unusual file uploads and applying web application firewall (WAF) rules to block suspicious AJAX requests may provide some protection.