CVE-2024-8704: LFI in Advanced File Manager WordPress Plugin

The impact of CVE-2024-8704 is significant due to the potential for code execution. An attacker who has administrator access can leverage this vulnerability to include and execute arbitrary PHP files, effectively gaining control over the server. This could involve uploading malicious images or other file types that can be included, then executing arbitrary code within those files. The attacker could then steal sensitive data, modify website content, install malware, or even compromise the entire WordPress installation. This vulnerability shares similarities with other LFI exploits where attackers leverage file inclusion to bypass access controls and execute malicious code.

1. Reserved2024-09-11
2. Published2024-09-26
3. EPSS updated2026-04-02

The primary mitigation for CVE-2024-8704 is to upgrade the Advanced File Manager plugin to a version that addresses the vulnerability. If immediate upgrading is not possible due to compatibility issues or breaking changes, consider temporarily restricting file upload permissions to prevent attackers from uploading files that can be included. Review server configurations to ensure proper file access controls are in place. Implement a Web Application Firewall (WAF) with rules to block suspicious file inclusion attempts targeting the 'fmalocale' parameter. After upgrading, verify the fix by attempting to access a non-existent file through the 'fmalocale' parameter and confirming that it results in an error, rather than file inclusion.

Active installs

100KNiche

Plugin rating