PT-2025-21264 · WordPress · Advanced-File-Manager-Pro-Premium+1

Published 2025-05-15 · Updated 2025-07-01 · CVE-2024-13914

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: File Manager Advanced Shortcode WordPress plugin versions up to, and including, 2.5.4 advanced-file-manager-pro-premium versions up to, and including, 2.5.6

Description: The issue allows authenticated attackers with Administrator-level access and above to include and execute arbitrary JavaScript files on the server via the 'file manager advanced' shortcode. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

Recommendations: For versions up to, and including, 2.5.4 of the File Manager Advanced Shortcode WordPress plugin, update to version 2.6.0 of the advanced-file-manager-pro-premium. As a temporary workaround, consider restricting access to the file manager advanced shortcode until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-13914

Affected Products

Advanced File Manager Shortcodes

Advanced-File-Manager-Pro-Premium

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-13914 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/1500c72a-0621-4f97-9cab-0c9c8abeaf8f?source=cve · Note
• https://t.me/cvenotify/122270 · Telegram Post
• https://twitter.com/CVEnew/status/1922892547786998191 · Twitter Post
• https://t.me/cvenotify/127285 · Telegram Post
• https://t.me/cvetracker/23889 · Telegram Post
• https://advancedfilemanager.com · Note
• https://twitter.com/VulmonFeeds/status/1922917795538350378 · Twitter Post