https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-8918.htmlhttps://patchthecve.com/cve/CVE-2024-8918.htmlWed, 17 Jun 2026 08:23:33 +0000HIGH 7.4: The File Manager Pro plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 8.3.9. This is due to a lack of proper checks on allowed file types. This makes it possible for unauthenticated attackers, with permissions granted by an administrator, to https://patchthecve.com/cve/CVE-2024-8746.htmlhttps://patchthecve.com/cve/CVE-2024-8746.htmlWed, 17 Jun 2026 08:23:13 +0000HIGH 7.5: The File Manager Pro plugin for WordPress is vulnerable to arbitrary backup file downloads and uploads due to missing file type validation via the 'mk_file_folder_manager_shortcode' ajax action in all versions up to, and including, 8.3.9. This makes it possible for unauthenticated attackers, if granhttps://patchthecve.com/cve/CVE-2024-8507.htmlhttps://patchthecve.com/cve/CVE-2024-8507.htmlWed, 17 Jun 2026 08:22:45 +0000HIGH 8.8: The File Manager Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.3.9. This is due to missing or incorrect nonce validation on the 'mk_file_folder_manager' ajax action. This makes it possible for unauthenticated attackers to upload arbitrarhttps://patchthecve.com/cve/CVE-2018-25105.htmlhttps://patchthecve.com/cve/CVE-2018-25105.htmlWed, 17 Jun 2026 01:54:43 +0000CRITICAL 9.8: The File Manager plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the /inc/root.php file in versions up to, and including, 3.0. This makes it possible for unauthenticated attackers to download arbitrary files from the server and upload arbitrary files https://patchthecve.com/cve/CVE-2024-2654.htmlhttps://patchthecve.com/cve/CVE-2024-2654.htmlWed, 17 Jun 2026 07:24:58 +0000MEDIUM 6.8: The File Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.2.5 via the fm_download_backup function. This makes it possible for authenticated attackers, with administrator access and above, to read the contents of arbitrary zip files on the serv