Description
WordPress Plugin wp-FileManager is prone to an arbitrary file disclosure vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to view local files in the context of the web server process, which may aid in launching further attacks. WordPress Plugin wp-FileManager version 1.3.0 is vulnerable; other versions may also be affected.
Remediation
Update to plugin version 1.4.0 or latest
References
http://www.exploit-db.com/exploits/25440/
http://packetstormsecurity.com/files/121637/WordPress-wp-FileManager-File-Download.html
Related Vulnerabilities
WordPress Plugin Gravity Forms Advanced File Uploader Unspecified Vulnerability (1.18)
Oracle JRE CVE-2012-0504 Vulnerability (CVE-2012-0504)
Oracle HTTP Server Uncontrolled Resource Consumption Vulnerability (CVE-2022-25313)
Drupal Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-5651)
WordPress Plugin Contact Form DB Cross-Site Scripting (2.8.19)