CVE-2024-1538: The File Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.4. This is due to missing or incorrect nonce validation on the wp_file_manag

high Affects wp-file-manager (WordPress plugin). Feed 2026.10.29.3, updated 2026-10-29; published 2024-03-21; advisory modified 2026-06-17.

The File Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.4. This is due to missing or incorrect nonce validation on the wp_file_manag

Package: wp-file-manager (WordPress plugin) WordPress
Affected versions: <7.2.5
Fixed in: 7.2.5
Severity: high CVSS 8.8
Exploitation: not on CISA KEV · EPSS 11% (95.8th percentile)
Published: 2024-03-21
Source: nvd

References

CWE-352

NVD record wp-file-manager (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden wordpress /var/www/html

# or, without Composer
pipx install phpwarden   &&   phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2020-25213 KEV critical Unauthenticated arbitrary file upload to RCE via the elFinder connector same package: wp-file-manager (WordPress plugin)
CVE-2023-6825 critical The File Manager and File Manager Pro plugins for WordPress are vulnerable to Directory Tr same package: wp-file-manager (WordPress plugin)
CVE-2018-16967 medium There is an XSS vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress vi same package: wp-file-manager (WordPress plugin)
CVE-2024-0761 high The File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in a same package: wp-file-manager (WordPress plugin)
CVE-2018-16966 high There is a CSRF vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress vi same package: wp-file-manager (WordPress plugin)
CVE-2024-2654 medium The File Manager plugin for WordPress is vulnerable to Directory Traversal in all versions same package: wp-file-manager (WordPress plugin)