Missing authorization check enables file-upload restriction changes in File Manager Pro - Filester

The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'njt_fs_saveSettingRestrictions' function in all versions up to, and including, 1.8.2. This makes it possible for authenticated attackers, with a role that has been granted permissions by an Administrator, to update the plugin settings for user role restrictions, including allowing file types such as.php to be uploaded.

• The ninjateam File Manager Pro - Filester WordPress plugin is affected in all versions from 0 through and including 1.8.2, according to the supplied affected facts.
• Wordfence identifies 1.8.3 as the patched version for the affected branch.
• The status of every later or parallel release branch is not separately established by the normalized facts; do not infer that all later versions are safe solely because 1.8.3 is patched.

The flaw is in the njt_fs_saveSettingRestrictions function in the File Manager Pro - Filester plugin. The handler updates user-role restriction settings without checking whether the caller has the capability required to change those settings. A WordPress nonce used in the request flow does not replace authorization, because a nonce can be issued to users who have been granted access to the plugin by an Administrator. An authenticated attacker can therefore change role-specific restrictions, including allowing file types such as .php to be uploaded; the available evidence does not establish every subsequent step after upload or code execution on every server configuration.

The vulnerable flow is reachable over the network through WordPress's AJAX handling and requires an authenticated attacker. The account must belong to a role that an Administrator has allowed to use the plugin, but it does not necessarily need to be an Administrator account. The normalized record describes low attack complexity, low privileges, and no user interaction; the Wordfence advisory gives a different complexity assessment, so that detail is inconsistent across the available sources. A public technical write-up describes the HTTP request and the restriction change, but the supplied evidence does not confirm exploitation in production environments.

The flaw lets an authenticated user modify plugin configuration data without the appropriate capability. The direct result is that user-role restrictions can be changed, weakening controls over file uploads and allowing types such as .php. Further impact depends on the account's permissions, the File Manager Pro - Filester configuration, how the server handles uploaded files, and other security controls. Unauthorized site modification, data impact, or code execution are possible consequences in some configurations, not outcomes established for every deployment.

• An authenticated WordPress account with plugin access can weaken file restrictions set by an Administrator.
• Allowing executable file types can increase the risk of unauthorized changes to site content or stored data.
• Depending on server configuration, file permissions, and other controls, the change could enable broader effects on site integrity or availability.
• The vulnerability alone does not prove that account takeover, code execution, or data disclosure occurred.

1. Upgrade promptly File Manager Pro - Filester to the fixed version 1.8.3, which Wordfence identifies as the patched release for the affected branch.
2. If an immediate upgrade is not possible, temporarily restrict or remove plugin access for roles that do not need it, especially roles that can upload files. This reduces exposure but does not replace the patch.
3. Review and restore role-specific restrictions, ensuring that dangerous file types such as .php are not allowed unless explicitly required and controlled.
4. After upgrading, verify the installed version on every site and recheck role permissions and recent plugin-setting changes.
5. Do not treat another release as safe without clear vendor confirmation or an advisory covering the exact release branch in use.

• Inventory WordPress sites running the filester plugin and identify the installed version from the plugin inventory or plugin files.
• Review which WordPress roles have been granted access to File Manager Pro - Filester, especially roles below Administrator.
• Review role-specific restrictions and confirm that dangerous extensions, including .php, remain blocked under the organization's policy.
• Review web server, WAF, or application logs for requests to wp-admin/admin-ajax.php using the njt_fs_save_setting_restrictions action; this is a precautionary review, not a confirmed IOC.
• If unexpected role restrictions or upload permissions are found, preserve relevant logs and investigate authenticated accounts that had access to the plugin.