CVE-2023-5907

Name of the Vulnerable Software and Affected Versions File Manager WordPress plugin versions prior to 6.3

Description The issue allows an administrator to set a root outside of the WordPress root directory, giving access to system files and directories even in a multisite setup, where site administrators should not be allowed to modify the site's files.

Recommendations For versions prior to 6.3, update to version 6.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the file manager's root directory to prevent administrators from setting a root outside of the WordPress root directory.