CVE-2025-3234 is a high-severity vulnerability in the File Manager Pro – Filester plugin for WordPress, identified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The issue arises from the plugin's failure to validate file types during uploads, allowing authenticated administrators or users with elevated privileges to upload arbitrary files. This flaw exists in all versions up to and including 1.8.8. The vulnerability could enable remote code execution if exploited. Additionally, the ability for administrators to delegate file manager privileges to lower-level users increases the risk and potential impact.

Successful exploitation allows authenticated users with Administrator or higher privileges to upload arbitrary files to the server, potentially leading to remote code execution. This compromises confidentiality, integrity, and availability of the affected WordPress site. The risk escalates if file manager privileges are extended to lower-privileged users, broadening the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file manager privileges strictly to trusted administrators and avoid extending these privileges to lower-level users. Monitor for updates from the vendor ninjateam regarding patches or official mitigations.