CVE-2023-6846 is a high severity (CVSS 8.8) arbitrary file upload flaw in the File Manager Pro plugin for WordPress, all versions through 8.3.4. Subscribers and above can run code on the server. Version 8.3.5 adds a capability check, so update to 8.3.5 or later.
What's affected
The record says all versions up to and including 8.3.4 are affected and that version 8.3.5 introduces a capability check that prevents users lower than admin from running the vulnerable function. That makes 8.3.5 the fixed version per the record.
The flaw is in the mk_check_filemanager_php_syntax AJAX function. Authenticated attackers with subscriber access and above can use it, so any site with public registration is more exposed.
How to check if you're exposed
Run these from your WordPress root with WP-CLI. They only read.
wp plugin list --fields=name,status,version,update
wp plugin get wp-file-manager --field=version
Look for File Manager Pro by name. Versions through 8.3.4 are affected and 8.3.5 is the fixed version. If WP-CLI is not available, open Plugins in the dashboard and read the version under the plugin name. Also check staging copies, old backups restored to test sites, and multisite networks, where the plugin may be installed on only some sites.
File Manager Pro is a commercial add-on, so the update may come from the vendor rather than WordPress.org.
What to do now
- Update File Manager Pro to 8.3.5 or newer.
- Check upload folders and the web root for unexpected PHP files.
- Review user accounts, especially recent low-privilege signups.
- If you do not need the plugin, delete it.
Why it matters
The record explains that the AJAX function checks PHP syntax and fails to restrict who may call it. A low-privilege user can get a file to the server and have code run. The record tags CWE-94, code injection, and CWE-434, unrestricted upload of dangerous file types.
Unrestricted file upload turns a file feature into a code delivery path. When a server stores a file in a web-reachable folder and does not check what kind of file it is, a script that the web server will run can end up where it can be requested. Allow lists of file types, renaming on save, and storing uploads outside the web root are the standard defenses.
Patch priority depends on who can reach the flaw. Issues open to anonymous visitors come first, then issues that need a low-privilege account, then issues that need an administrator. Use the access level in the description to place this item in your queue, and write down the date you updated so you can answer later when someone asks whether a given site was exposed.
Weakness class in the record: CWE-94 (Code Injection) CWE-434 (Unrestricted File Upload).
Quick check
Is this the same as CVE-2023-6825?
No. Both affect File Manager plugins, but CVE-2023-6825 is a path traversal flaw and this one is an upload flaw reached through a different function.
How do I find every site that runs this plugin?
Check your hosting dashboards and any site management tool, and run the WP-CLI commands above on each install. Agencies and hosts often forget staging copies and sites inherited from clients.
Sources
Last reviewed: 19 October 2026.
