What is the CVSS score of CVE-2023-6846?

CVE-2023-6846 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 13.3%.

Which versions of File Manager Pro are affected by CVE-2023-6846?

WordPress File Manager Pro plugin (versions ≤8.3.4) contains a remote code execution vulnerability allowing subscriber-level users to take control of servers.

Is there a public PoC exploit available for CVE-2023-6846?

Yes, a public proof-of-concept exploit is available for CVE-2023-6846. Prioritise patching immediately. EPSS: 13.3%.

How to fix or mitigate CVE-2023-6846?

Within 24 hours: Identify all WordPress installations running File Manager Pro versions ≤8.3.4 and assess the number and privileges of subscriber accounts with access. Within 7 days: Upgrade all affected installations to version 8.3.5 or later. Within 30 days: Audit server logs for unauthorized file uploads via the mk_check_filemanager_php_syntax endpoint and restrict file upload permissions to trusted roles.

File Manager Pro CVE-2023-6846

HIGH

Code Injection (CWE-94)

2024-02-05 security@wordfence.com

Code Injection RCE WordPress File Upload File Manager

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Apr 08, 2026 - 17:17 vuln.today

Public exploit code

CVE Published

Feb 05, 2024 - 22:15 nvd

HIGH 8.8

DescriptionCVE.org

The File Manager Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.3.4 via the mk_check_filemanager_php_syntax AJAX function. This makes it possible for authenticated attackers, with subscriber access and above, to execute code on the server. Version 8.3.5 introduces a capability check that prevents users lower than admin from executing this function.

AnalysisAI

Remote code execution in the WordPress File Manager Pro plugin (versions up to and including 8.3.4) allows authenticated attackers with subscriber-level access to upload arbitrary files via the mk_check_filemanager_php_syntax AJAX endpoint, leading to full server compromise. Publicly available exploit code exists, and the high EPSS score of 13.31% (94th percentile) indicates significant real-world exploitation likelihood. The flaw is patched in version 8.3.5, which introduces a missing capability check.

Technical ContextAI

File Manager Pro is a commercial WordPress plugin for managing files on the server through the WP admin interface. The root cause is CWE-94 (Improper Control of Generation of Code / Code Injection): the mk_check_filemanager_php_syntax AJAX action lacked a capability check, so any logged-in user - including the lowest-privilege subscriber role - could invoke functionality intended only for administrators and write PHP files into the webroot. WordPress sites that allow open user registration (a common e-commerce, membership, or community configuration) effectively expose this admin-only function to anyone on the internet. The CPE cpe:2.3:a:filemanagerpro:file_manager:*:*:*:*:*:wordpress:*:* covers all File Manager Pro plugin installations on WordPress.

RemediationAI

Upgrade File Manager Pro to version 8.3.5 or later, which adds the capability check that prevents non-admin users from invoking mk_check_filemanager_php_syntax. Until the upgrade is applied, administrators should disable open user registration in WordPress (Settings → General → 'Anyone can register') to remove the subscriber attack surface - accepting the trade-off that this also blocks legitimate self-signup on membership/e-commerce sites; alternatively, disable or uninstall the File Manager Pro plugin entirely, which removes the file-management UI for admins but eliminates the vulnerable endpoint. A WAF rule blocking POST requests to admin-ajax.php with action=mk_check_filemanager_php_syntax from non-administrative sessions is a viable compensating control with low operational impact. Audit existing uploads, user accounts, and PHP files in wp-content for indicators of prior compromise before patching.