PatchTheCVECVE-2024-8507: The File Manager Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, a
CVE-2024-8507 is a high-severity flaw (CVSS 8.8) affecting file manager. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The File Manager Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.3.9. This is due to missing or incorrect nonce validation on the 'mk_file_folder_manager' ajax action. This makes it possible for unauthenticated attackers to upload arbitrary files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Why this priority
- High severity
A fixed release or distro patch exists.
Risk facts
| CVSS score | 8.8 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 0.3% (top 83%) |
| CISA exploited list | No |
| Weakness | CWE-352 |
| Published | 2024-10-16 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-8507?
file manager: upgrade to 8.3.10. Exact commands for each OS are on this page.
Is CVE-2024-8507 being exploited?
CVE-2024-8507 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-8507 affect?
CVE-2024-8507 affects file manager. Severity is high (CVSS 8.8). The File Manager Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.3.9. This is due to missing or incorrect nonce validation on the 'mk_file_folder_manager' ajax action. This makes
How urgent is CVE-2024-8507?
Priority 35/100. High severity
Software pages
Related CVEs
- CVE-2025-63678 HIGH 7.2 DOWNGRADE An authenticated arbitrary file upload vulnerability in the /uploads/ endpoint of CMS Made Simple Foundation F
- CVE-2024-8918 HIGH 7.4 UPGRADE The File Manager Pro plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up t
- CVE-2024-8746 HIGH 7.5 UPGRADE The File Manager Pro plugin for WordPress is vulnerable to arbitrary backup file downloads and uploads due to
- CVE-2024-7770 HIGH 8.8 UPGRADE The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress
- CVE-2024-7627 HIGH 8.1 UPGRADE The Bit File Manager plugin for WordPress is vulnerable to Remote Code Execution in versions 6.0 to 6.5.5 via