Low-privilege file read and overwrite via fma_load_fma_ui

Missing authorization in WPExperts Advanced File Manager before 5.4.13 allows remote authenticated users to read and overwrite server files via AJAX actions. In class_fma_main::fma_load_fma_ui, the wp_ajax_fma_load_fma_ui handler passes requests to class_fma_connector->fma_local_file_system() after nonce validation alone, with no capability check on the caller or requested file command. Exposure requires an administrator to grant a role access to the plugin's file manager; once reachable, Subscriber-level users can read sensitive configuration files and overwrite existing non-PHP files, enabling compromise of administrator accounts and the site.