File Manager Pro CVE-2023-6846

Exploitation requires an authenticated WordPress account at the subscriber role or higher (PR:L), and the File Manager Pro plugin must be installed and active at version 8.3.4 or earlier. The practical limiting factor is account creation: on sites with open user registration enabled (a default for many WooCommerce, BuddyPress, LMS, and community deployments), attackers can self-provision the required account, effectively making this remotely exploitable; on sites with registration disabled, the attacker must first compromise or be issued any low-privilege credential. No user interaction is needed (UI:N), the attack is over the network (AV:N), and complexity is low (AC:L).

All signals point toward this being a genuine priority, not an inflated CVSS issue. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with full CIA impact. EPSS of 13.31% (94th percentile) is unusually high and aligns with publicly available exploit code. The vulnerability is not currently listed in CISA KEV, so there is no confirmed active exploitation, but the combination of a public POC, trivial preconditions (a free subscriber account), and the prevalence of WordPress sites with open registration makes mass exploitation realistic. The only mitigating factor - PR:L instead of PR:N - is essentially meaningless on any site that permits self-registration, which is the default for WooCommerce, BuddyPress, LMS, and similar deployments.

An attacker registers a free subscriber-level account on a vulnerable WordPress site (or uses any pre-existing low-privilege credential), then sends a crafted POST request to /wp-admin/admin-ajax.php invoking the mk_check_filemanager_php_syntax action with a malicious PHP payload. The plugin processes the request without verifying administrative capability and writes the payload to disk, which the attacker then requests over HTTP to achieve code execution as the web server user. A public POC is available, lowering the skill barrier considerably.