CVE-2022-3124

published 2022-10-03

CVE-2022-3124: The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack…

Priority P2 77 medium 5.3 CVSS 3.1

AV N AC L PR N UI N S U C N I L A N

ITW EXPLOIT VulnCheck KEV

The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack of validation in the destination filename, this could allow allow them to change the content of arbitrary files on the web server

Affected

1 ranges

Vendor	Product	Version range	Fixed in
najeebmedia	frontend_file_manager	< 21.3	21.3

Detection & IOCs extracted from sources · hover to see the quote

url POST /wp-json/wpfm/v1/file-rename↗

path /wp-content/plugins/nmedia-user-file-uploader/↗

command fileid=1&filename=../../../../{{rand_string}}.php↗

• → Detect unauthenticated POST requests to the WordPress REST API endpoint /wp-json/wpfm/v1/file-rename with no Authorization header, indicating exploitation of CVE-2022-3124. ↗
• → Look for path traversal sequences (e.g., ../../../../) in the 'filename' POST parameter of requests to /wp-json/wpfm/v1/file-rename, which indicates an attempt to rename/overwrite arbitrary files. ↗
• → A JSON response body containing both 'fileid' and 'filename' keys with HTTP 200 and Content-Type application/json confirms successful exploitation of the file rename endpoint. ↗
• → Presence of the plugin directory /wp-content/plugins/nmedia-user-file-uploader/ on a WordPress site indicates the vulnerable Frontend File Manager plugin is installed. ↗

• · The vulnerability affects Frontend File Manager Plugin versions before 21.3 only; sites running 21.3 or later are not affected. ↗
• · The path traversal payload uses a randomised .php filename (rand_text_alpha), so static filename-based detection will not reliably catch all exploitation attempts; focus on the traversal pattern and endpoint instead. ↗

CVSS provenance

nvd v3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

osv 5.3 MEDIUM

vulncheck 5.3 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-862