Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2008-0222: WordPress FileManager plugin lets attackers run code
CVE-2008-0222 · published 18 years ago
Summary
The FileManager plugin for WordPress lets anyone upload files without proper checks. A malicious user could place a script on your site and have it executed, potentially taking control of the site. Update the plugin to the latest version or remove it if it is not needed, and ensure only trusted users can upload files.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| wordpress | filemanager |
1.2 cpe:2.3:a:wordpress:filemanager:1.2:*:*:*:*:*:*:* |
Original advisory text
Unrestricted file upload vulnerability in ajaxfilemanager.php in the Wp-FileManager 1.2 plugin for WordPress allows remote attackers to upload and execute arbitrary PHP code via unspecified vectors.
Unrestricted file upload vulnerability in ajaxfilemanager.php in the Wp-FileManager 1.2 plugin for WordPress allows remote attackers to upload and execute arbitrary PHP code via unspecified vectors.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Severity
7.5
High
Type
CWE-94Code Injection
Timeline
Published10 Jan 2008
Updated15 Oct 2026
First seen29 Sep 2026
Sources
CVE-2008-0222 · NVD
Track software like this
Free during beta