CVE-2024-8746 is a vulnerability in the File Manager Pro plugin for WordPress caused by unrestricted upload and download of files with dangerous types due to lack of file type validation in the 'mk_file_folder_manager_shortcode' ajax action. This affects all versions up to and including 8.3.9. The vulnerability allows unauthenticated attackers, who have been granted access to the File Manager by an administrator, to arbitrarily upload and download backup files on the affected server. This can potentially lead to remote code execution. The CVSS 3.1 base score is 7.5, indicating high severity, with attack vector network, high attack complexity, no privileges required, user interaction required, and impacts to confidentiality, integrity, and availability.

Successful exploitation allows unauthorized file uploads and downloads on the server hosting the vulnerable WordPress plugin. This can lead to disclosure of sensitive backup files and potentially remote code execution, compromising the confidentiality, integrity, and availability of the affected system. The vulnerability requires that an attacker be granted access to the File Manager by an administrator, and user interaction is needed to trigger the exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should restrict access to the File Manager plugin to trusted users only and consider disabling or removing the plugin if not essential. Monitor for updates from the vendor regarding patches or official mitigations.