CVE-2023-6825

The File Manager plugin for WordPress through version 7.2.1 contains a directory traversal vulnerability in the mk_file_folder_manager_action_callback_shortcode function's target parameter that allows authenticated administrators to read arbitrary files from the server and upload files to unintended directories. The Pro version of the plugin extends this risk by enabling administrators to grant file management capabilities to lower-privileged users, potentially exposing the vulnerability to non-admin accounts. An attacker exploiting this flaw could access sensitive server files or place malicious uploads in locations outside the designated upload directory.

Based on public CVE data (MITRE/NVD).