CVSS 3.1 Score 9.9 of 10 (high)


Published Mar 13, 2024


CVE-2023-6825 is a critical vulnerability affecting the File Manager and File Manager Pro plugins for WordPress. Versions up to and including 7.2.1 (free version) and 8.3.4 (Pro version) are vulnerable to Directory Traversal. Attackers can exploit this vulnerability by manipulating the target parameter in the mk_file_folder_manager_action_callback_shortcode function, allowing them to read the contents of arbitrary files on the server and upload files into unintended directories. The free version requires Administrator access to be exploitable, while the Pro version enables lower-level users to potentially exploit this vulnerability. The risk score is 65, with high impacts on confidentiality and integrity, as well as a high availability impact. Remediation should involve updating the affected plugins to the latest versions as soon as possible.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-6825 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options