CVE-2025-3234: 
WordPress vulnerability analysis and mitigation

The File Manager Pro – Filester plugin for WordPress contains an arbitrary file upload vulnerability (CVE-2025-3234) affecting all versions up to and including 1.8.8. The vulnerability was discovered and reported by Wordfence on June 14, 2025 (NVD Report, Wiz Report).

The vulnerability stems from missing file type validation in the plugin's file upload functionality. It has been assigned a CVSS v3.1 base score of 7.2 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The vulnerability is categorized under CWE-434 (Unrestricted Upload of File with Dangerous Type) (NVD Report).

The vulnerability allows authenticated attackers with Administrator-level access and above to upload arbitrary files to the affected site's server, potentially enabling remote code execution. The impact is more severe on sites where administrators have extended file manager usage privileges to lower-level users including subscribers (NVD Report).

The vulnerability has been patched in version 1.8.9 of the Filester plugin. Site administrators are strongly advised to update to this latest version which includes security improvements and fixes the file type validation issue (WordPress Changelog).