An advisory was issued for 3 WordPress file administration plugins which are affected by a vulnerability that enables unauthenticated attackers delete arbitrary information. The three plugins are put in in over 1.3 million web sites.
Outdated Model Of elFinder
The vulnerability is attributable to outdated variations of the elFinder file supervisor, particularly variations 2.1.64 and earlier. These variations include a Listing Traversal vulnerability that enables attackers to control file paths to succeed in exterior the meant listing. By sending requests with sequences corresponding to instance.com/../../../../, an attacker may make the file supervisor entry and delete arbitrary information.
Affected Plugins
Wordfence named the next three plugins as affected by this vulnerability:
1. File Supervisor WordPress Plugin
Installations: 1 Million
2. Superior File Supervisor – Final WP File Supervisor And Doc Library Resolution
Installations: 200,000+
3. File Supervisor Professional – Filester
Installations: 100,000+
Based on the Wordfence advisory, the vulnerability may be exploited with out authentication, however provided that a web site proprietor has made the file supervisor publicly accessible, which mitigates the potential of exploitation. That mentioned, two of the plugins indicated of their changelogs that an attacker wants at the least a subscriber degree authentication, the bottom degree of web site credentials.
As soon as exploited, the flaw allowed deletion of arbitrary information. Customers of the named WordPress plugins ought to think about updating to the newest variations.
Featured Picture by Shutterstock/Lili1992
