Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2016-15042 — Unrestricted File Upload in Frontend File Manager Plugin

CWE-434 — Unrestricted File Upload5 documents5 sources
Severity
9.8CRITICALNVD
EPSS
73.9%
top 1.18%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
4
Nmedia Frontend File Manager PluginNajeebmedia Frontend File ManagerNajeebmedia Post Front-end Form+1 more
Timeline
PublishedOct 16

Description

The Frontend File Manager (versions < 4.0), N-Media Post Front-end Form (versions < 1.1) plugins for WordPress are vulnerable to arbitrary file uploads due to missing file type validation via the `nm_filemanager_upload_file` and `nm_postfront_upload_file` AJAX actions. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages4 packages

🔴Vulnerability Details

3
GHSA
GHSA-98v8-mh4j-wqg7: The Frontend File Manager (versions < 4↗2024-10-16
▶
CVEList
Frontend File Manager < 4.0 & N-Media Post Front-end Form < 1.1 & - Arbitrary File Upload↗2024-10-16
▶
VulnCheck
Frontend File Manager and N-Media Post Front-end Form plugins for WordPress nm_filemanager_upload_file and nm_postfront_upload_file AJAX Vulnerability↗2016
▶

💥Exploits & PoCs

1
Nuclei
WordPress Frontend File Manager < 4.0 & N-Media Post Frontend < 1.1 - Arbitrary File Upload
▶
CVE-2016-15042 — Unrestricted File Upload | cvebase