CVE-2021-4368

published 2023-06-07

CVE-2021-4368: The Frontend File Manager plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to, and including, 18.2. This is due to lacking…

Priority P2 59 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

The Frontend File Manager plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to, and including, 18.2. This is due to lacking capability checks and a security nonce, all on the wpfm_save_settings AJAX action. This makes it possible for subscriber-level attackers to edit the plugin settings, such as the allowed upload file types. This can lead to remote code execution through other vulnerabilities.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
najeebmedia	frontend_file_manager_plugin	<= 18.2	—
nmedia	frontend_file_manager_plugin	< 18.3	18.3

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-862