The Advanced File Manager plugin for WordPress suffers from a path traversal vulnerability (CWE-22) that enables Local JavaScript File Inclusion through the 'fma_locale' parameter. Authenticated users with Administrator privileges can exploit this flaw to include arbitrary files on the server, leading to arbitrary PHP code execution. This can bypass access controls and compromise confidentiality, integrity, and availability of the affected system. The CVSS v3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official vendor advisory is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker with administrator-level access to execute arbitrary PHP code on the server, bypass access controls, and potentially access sensitive data. This compromises the confidentiality, integrity, and availability of the affected WordPress installation. The vulnerability is significant due to the ability to execute code remotely with high privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and monitor for suspicious activity related to file inclusion. Avoid uploading untrusted files and consider disabling or limiting the use of the vulnerable plugin if possible.