CVE-2024-8126: 
WordPress vulnerability analysis and mitigation

The Advanced File Manager plugin for WordPress (CVE-2024-8126) contains an arbitrary file upload vulnerability in the 'classfmaconnector.php' file, affecting all versions up to and including 5.2.8. This vulnerability was discovered and reported by Wordfence (Wordfence Advisory).

The vulnerability allows authenticated attackers with Subscriber-level access and above, who have been granted permissions by an Administrator, to upload a new .htaccess file. The CVSS v3.1 base score is 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, as assessed by NVD. The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) (NVD).

The vulnerability enables attackers to upload arbitrary files to the affected site's server, which could potentially lead to remote code execution. This poses a significant security risk as it could allow attackers to gain unauthorized access to the server and execute malicious code (NVD).

Website administrators should update the Advanced File Manager plugin to version 5.2.9 or later, which contains the security fix for this vulnerability (WordPress Plugin).