File Manager Vulnerability- Directory Traversal – CVE-2023-6825 | WordPress Plugin Vulnerability Report 

Plugin Name: File Manager

Key Information:

  • Software Type: Plugin
  • Software Slug: wp-file-manager
  • Software Status: Active
  • Software Author: mndpsingh287
  • Software Downloads: 20,544,237
  • Active Installs: 1,000,000
  • Last Updated: March 7, 2024
  • Patched Versions: 7.2.2
  • Affected Versions: <= 7.2.1

Vulnerability Details:

  • Name: File Manager And File Manager Pro (Multiple Versions)
  • Type: Directory Traversal
  • CVE: CVE-2023-6825
  • CVSS Score: 9.9
  • Publicly Published: March 4, 2024
  • Researcher: Tobias Weißhaar
  • Description: The File Manager and File Manager Pro plugins for WordPress are vulnerable to Directory Traversal via the target parameter in the mk_file_folder_manager_action_callback_shortcode function in versions up to and including 7.2.1 (free version) and 8.3.4 (Pro version). This vulnerability allows attackers to read the contents of arbitrary files on the server and upload files to unintended directories, potentially containing sensitive information. The free version requires Administrator access to exploit this vulnerability, while the Pro version can be exploited by lower-level users through a shortcode that embeds a file manager with adjustable file handling privileges.


The File Manager plugin for WordPress has a vulnerability in versions up to and including 7.2.1 that allows for Directory Traversal attacks. This vulnerability has been patched in version 7.2.2.

Detailed Overview:

Discovered by researcher Tobias Weißhaar, this Directory Traversal vulnerability in both the File Manager and File Manager Pro plugins poses a significant risk by enabling attackers to gain unauthorized access to sensitive files on the server. It also allows for the uploading of files to directories outside the designated file upload area. The exploitation of this vulnerability could lead to a breach of sensitive information or unauthorized file manipulation, underlining the critical nature of this security flaw. The developers have responded with a patch in version 7.2.2, which addresses these concerns.

Advice for Users:

  • Immediate Action: Users are strongly encouraged to update to the patched version 7.2.2 immediately.
  • Check for Signs of Vulnerability: Regularly monitor your file directories for unexpected changes or additions that could indicate exploitation.
  • Alternate Plugins: While the patched version is available, users may consider exploring alternative plugins offering similar functionality as a precautionary measure.
  • Stay Updated: Continuously update all WordPress plugins to their latest versions to mitigate the risk of vulnerabilities.


The swift action taken by the developers to release a patch for this vulnerability highlights the critical importance of keeping software up-to-date. Users should ensure their installations are updated to version 7.2.2 or later to protect their WordPress sites from potential exploitation.


In today's digital era, maintaining the security and integrity of your online presence is paramount, especially when your business hinges on the reliability of your website. A recent discovery highlights the critical need for regular updates and security checks. The File Manager plugin, a popular tool among WordPress users for managing files within the WordPress dashboard, has been found to contain a severe Directory Traversal vulnerability, identified as CVE-2023-6825. This security flaw not only underscores the risks lurking in outdated software but also serves as a stark reminder of the ongoing battle against cyber threats.

The Vulnerability at a Glance:

The File Manager plugin, with over 1,000,000 active installs and developed by mndpsingh287, recently caught the attention of the cybersecurity community due to a critical Directory Traversal vulnerability affecting versions up to 7.2.1. Discovered by researcher Tobias Weißhaar, this vulnerability allows attackers to bypass normal access controls, read sensitive files, and upload malicious content to unintended directories on the server. The potential for damage is particularly high, given the plugin's widespread use, with a CVSS score of 9.9 indicating its severity.

Risks and Implications:

The implications of such a vulnerability cannot be overstated. Unauthorized access to sensitive files can lead to data breaches, compromising personal and business data. Moreover, the ability to upload files to the server paves the way for further exploits, including the deployment of malware and backdoors, which could lead to a complete takeover of the website.

Remediation and Prevention:

In response to this discovery, the developers of File Manager promptly released a patched version, 7.2.2, to address this vulnerability. Website owners and administrators are urged to update the plugin immediately to this latest version to secure their sites. Additionally, it's wise to conduct regular audits of file directories for any unusual activity or files that could indicate a compromise. For those seeking alternatives, exploring other plugins that offer similar functionality might provide an additional layer of security while the concerns are fully addressed.

Historical Context:

This is not the first time the File Manager plugin has been in the spotlight for security issues; since September 6, 2018, there have been 9 reported vulnerabilities. This history further emphasizes the importance of vigilance and the need for continuous monitoring of the software that powers your website.

Concluding Thoughts:

For small business owners, the task of staying abreast of every security update and potential vulnerability can seem daunting, particularly when resources are limited. However, the cost of neglecting these aspects can be far greater, leading to lost business, reputational damage, and regulatory penalties. Leveraging tools like security plugins, managed WordPress hosting services, and automated update solutions can significantly reduce the burden, allowing you to focus on your core business activities while ensuring that your website remains a secure and trusted platform for your customers.

In essence, the discovery of the CVE-2023-6825 vulnerability in the File Manager plugin serves as a critical reminder of the ever-present need for vigilance in the digital space. Staying informed, proactive in updating and securing your website, and seeking support when needed are key strategies to safeguard your online presence against the evolving landscape of cyber threats.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

File Manager Vulnerability- Directory Traversal – CVE-2023-6825 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment