Access violation vulnerability in File Manager 7.2.7

of arbitrary files and store them on the server. The File Manager plugin for WordPress has a security issue that allows people to change data without permission. This happens because the plugin doesn’t check for the right permissions on a specific function called mk_file_manager_backup_callback. This means that anyone who is logged in and has at least subscriber-level access can create backups of any file they want and save it on the server.