File Manager Pro CVE-2023-6846

Upgrade File Manager Pro to version 8.3.5 or later, which adds the capability check that prevents non-admin users from invoking mk_check_filemanager_php_syntax. Until the upgrade is applied, administrators should disable open user registration in WordPress (Settings → General → 'Anyone can register') to remove the subscriber attack surface - accepting the trade-off that this also blocks legitimate self-signup on membership/e-commerce sites; alternatively, disable or uninstall the File Manager Pro plugin entirely, which removes the file-management UI for admins but eliminates the vulnerable endpoint. A WAF rule blocking POST requests to admin-ajax.php with action=mk_check_filemanager_php_syntax from non-administrative sessions is a viable compensating control with low operational impact. Audit existing uploads, user accounts, and PHP files in wp-content for indicators of prior compromise before patching.