Back to Database
Status published
Critical
CVE-2018-25105
File Manager <= 3.0 - Unauthenticated Arbitrary File Upload/Download
Vulnerability Description
The File Manager plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the /inc/root.php file in versions up to, and including, 3.0. This makes it possible for unauthenticated attackers to download arbitrary files from the server and upload arbitrary files that can be used for remote code execution.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-25105
Credits & Attribution
No credits recorded in the NVD database.
References
More from mndpsingh287
View All →CVE-2025-9890
Theme Editor <= 3.0 - Cross-Site Request Forgery to Remote Code Execution
High
8.8
CVE-2025-68008
WordPress WP Mail plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability
High
7.1
CVE-2025-58822
WordPress WP Mail Plugin <= 1.3 - Cross Site Scripting (XSS) Vulnerability
Medium
6.5
CVE-2025-23536
WordPress Track Page Scroll plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability
High
7.1
CVE-2024-37254
WordPress WP File Manager plugin <= 7.2.7 - Broken Access Control vulnerability
Medium
4.3
Affected Vendor
mndpsingh287
View all reports →Affected Software
File Manager
Vulnerable Versions:
0
Timeline
Official Publish:
October 16th, 2024
Last Modified:
April 8th, 2026
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H