Global infos:

The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads via the 'class_fma_connector.php' file in all versions up to, and including, 5.2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an Administrator, to upload a new .htaccess file allowing them to subsequently upload arbitrary files on the affected site's server which may make remote code execution possible.

CVE Status: Analyzed

References:

[email protected]

[email protected]

[email protected]

Metrics:

Attribute	Value
Attack Complexity	HIGH
Attack Vector	NETWORK
Availability Impact	HIGH
Base Score	7.5
Base Severity	HIGH
Confidentiality Impact	HIGH
Integrity Impact	HIGH
Privileges Required	LOW
Scope	UNCHANGED
User Interaction	NONE
Vector String	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability Score	1.6
Impact Score	5.9
Source	[email protected]
Type	Secondary

Links:

Exploit-db
Github