CVE-2023-4827: Ninjateam Filester

High severity, CVSS 8.8. EPSS: 7.9% chance of exploitation in the next 30 days.

The File Manager Pro WordPress plugin before 1.8 does not properly check the CSRF nonce in the `fs_connector` AJAX action. This allows attackers to make highly privileged users perform unwanted file system actions via CSRF attacks by using GET requests, such as uploading a web shell.

Affected products

• Ninjateam Filester: before 1.8 (fixed in 1.8)

Published 2023-10-16. Last modified 2026-06-17.