CVE-2024-13333
Published: 17 January 2025
Summary
CVE-2024-13333 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Advancedfilemanager Advanced File Manager. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 4.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
The Advanced File Manager plugin for WordPress contains an arbitrary file upload vulnerability (CVE-2024-13333) in versions 5.2.12 through 5.2.13. The flaw stems from missing file type validation inside the fma_local_file_system function, which permits upload of arbitrary files when the “Display .htaccess?” option is enabled. The issue is tracked under CWE-434 and carries a CVSS 3.1 score of 7.5.
Authenticated attackers holding subscriber-level access or higher can exploit the weakness if an administrator has explicitly granted them upload rights. Successful exploitation allows the attacker to place malicious files on the server, which may then be executed to achieve remote code execution.
Public references include the plugin’s Trac repository showing the vulnerable code path and a subsequent changeset (3222740) that addresses the validation gap, along with a detailed Wordfence advisory. The associated EPSS score has remained flat at 0.1782 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51538
Vulnerability details
The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fma_local_file_system' function in versions 5.2.12 to 5.2.13. This makes it possible for authenticated attackers, with Subscriber-level access and above…
more
and upload permissions granted by an administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible. The function can be exploited only if the "Display .htaccess?" setting is enabled.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file upload in public-facing WordPress plugin directly enables T1190 exploitation; facilitates T1105 for malicious file ingress and T1505.003 web shell deployment leading to RCE.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the missing file type validation in the fma_local_file_system function by requiring comprehensive input validation for file uploads.
Remediates the arbitrary file upload flaw in vulnerable plugin versions 5.2.12 to 5.2.13 through timely identification, reporting, and patching.
Establishes secure configuration settings for the plugin, such as disabling the 'Display .htaccess?' option required for exploitation.