CVE-2024-7559

CVE-2024-7559 is a critical arbitrary file upload vulnerability affecting all versions of the File Manager Pro plugin for WordPress up to and including 8.3.7. This flaw, stemming from inadequate file type validation and capability checks, allows authenticated attackers with Subscriber-level access or higher to upload malicious files, potentially leading to remote code execution. With a CVSS score of 8.8 (HIGH), the vulnerability is easily exploitable over the network with low complexity, posing a significant risk of complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation, public exploit code, or significant community discussion, its high EPSS and FAUCET Risk Score indicate a substantial potential for future exploitation.