Attackers Target Critical Flaw in File Manager Plugin for WordPress

On September 1, Wordfence reported that attackers have been targeting a critical vulnerability in File Manager, a WordPress plugin that is used to manage files on WordPress sites. The plugin, which is actively installed on over 700,000 WordPress sites, is vulnerable to a command injection flaw that could lead to remote code execution. It received a CVSSv3 score of 10.0, the maximum score. It currently does not have a CVE identifier assigned to it.

For more information about the vulnerability, including the availability of patches and Tenable product coverage, please visit our blog.