The File Manager Pro – Filester plugin for WordPress contains a CWE-22 path traversal vulnerability identified as CVE-2024-9669. This vulnerability arises from improper limitation of a pathname to a restricted directory, specifically through the 'fm_locale' parameter. Authenticated attackers with Administrator privileges can exploit this flaw to include and execute arbitrary local JavaScript files on the server. This enables execution of arbitrary code, bypassing access controls and potentially exposing sensitive data. Although version 1.8.5 partially addresses the issue, the vulnerability remains in that version and earlier. There is no vendor advisory or patch link provided to confirm a complete fix.

Successful exploitation allows an authenticated administrator-level attacker to execute arbitrary code on the server, bypass access controls, and access sensitive data. This compromises the confidentiality, integrity, and availability of the affected system. The CVSS score of 7.2 reflects a high severity impact. No known exploits in the wild have been reported, but the vulnerability poses a significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability was partially patched in version 1.8.5, but since it remains vulnerable in that version, administrators should monitor for an official fix or update from the vendor. Until a full patch is available, restrict administrator access to trusted users only and consider disabling or removing the plugin if possible.