CVE-2024-13914: LFI in File Manager Advanced Shortcode

The primary impact of CVE-2024-13914 is the ability for an authenticated administrator to execute arbitrary JavaScript code on the server. This can be achieved by manipulating the 'filemanageradvanced' shortcode to include malicious JavaScript files. An attacker could leverage this to bypass access controls, potentially gaining unauthorized access to sensitive data stored within the WordPress environment. Furthermore, the ability to execute JavaScript opens the door to more severe attacks, such as session hijacking, cross-site scripting (XSS), and even remote code execution if the attacker can upload and include a file containing malicious code. The risk is amplified if the WordPress site handles sensitive user data or financial transactions.

1. Reserved2025-03-01
2. Published2025-05-15
3. Modified2025-07-01
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-13914 is to upgrade the File Manager Advanced Shortcode plugin to version 2.6.0 or later, which contains the fix for this vulnerability. If upgrading immediately is not possible due to compatibility issues or breaking changes, consider temporarily restricting administrator access to the file manager functionality. Additionally, implement strict file upload validation to prevent the upload of potentially malicious JavaScript files. Web Application Firewalls (WAFs) configured to detect and block suspicious file inclusion attempts can provide an additional layer of defense. Monitor WordPress logs for unusual file access patterns or JavaScript execution attempts.