Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution Security & Risk Analysis

The "file-manager-advanced" plugin v5.4.10 exhibits a mixed security posture. While it demonstrates several good security practices, including a complete absence of unprotected entry points (AJAX handlers, REST API routes, shortcodes, cron events) and a relatively high percentage of SQL queries using prepared statements and properly escaped outputs, significant concerns remain.

The static analysis reveals a substantial number of dangerous functions present in the codebase, including those that can lead to arbitrary code execution (exec, passthru, shell_exec) and deserialization vulnerabilities (unserialize, assert). Coupled with the taint analysis indicating multiple flows with unsanitized paths, including three critical severity issues, this points to a high risk of potential code execution and path traversal vulnerabilities if these flows are triggered by user input without proper sanitization or access control.

The plugin's vulnerability history is also a significant red flag. With a total of 9 known CVEs, predominantly categorized as High and Medium severity, and common types including missing authorization, cross-site scripting, and path traversal, it indicates a recurring pattern of security weaknesses. Although there are currently no unpatched CVEs, the historical prevalence of these vulnerability types suggests that the plugin may have systemic issues in handling user input and enforcing access controls. The most recent vulnerability in May 2025 further underscores the ongoing need for vigilance. In conclusion, while the plugin has made efforts in securing its entry points and core database operations, the presence of dangerous functions, critical taint flows, and a history of severe vulnerabilities necessitate a cautious approach and further investigation into the specific risks identified.