CVE-2018-19042

Name of the Vulnerable Software and Affected Versions Media File Manager plugin version 1.4.2

Description The issue allows for arbitrary file movement through a ../ directory traversal in the dir from and dir to parameters of an mrelocator move action to the "wp-admin/admin-ajax.php" URI.

Recommendations For Media File Manager plugin version 1.4.2, consider restricting access to the mrelocator move action in the "wp-admin/admin-ajax.php" URI until a patch is available. Avoid using the dir from and dir to parameters in the affected API endpoint until the issue is resolved.