Authenticated RCE vulnerability in WordPress Secure File Manager plugin (unpatched).
The WordPress Secure File Manager plugin (1,000 active installations) is prone to an authenticated remote code execution vulnerability affect version 2.5 and below.