Input validation vulnerability in Advanced File Manager 5.2.8

The Advanced File Manager plugin for WordPress has a security issue that allows attackers to upload any type of file through a specific file called ‘class_fma_connector.php’. This vulnerability exists in all versions up to and including 5.2.8. If an attacker has been given permissions by an Administrator and has Subscriber-level access, they can upload a new .htaccess file which gives them the ability to upload any file they want onto the website’s server. This could potentially lead to the attacker being able to execute code remotely on the affected site.