CVE-2021-4368

moderate-risk
Published 2023-06-07

The Frontend File Manager plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to, and including, 18.2. This is due to lacking capability checks and a security nonce, all on the wpfm_save_settings AJAX action. This makes it possible for subscriber-level attackers to edit the plugin settings, such as the allowed upload file types. This can lead to remote code execution through other vulnerabilities.

Do I need to act?

~
7.2% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.9/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Frontend File Manager Plugin

Affected Vendors

Najeebmedia

References (6)

Exploit https://blog.nintechnet.com/wordpress-frontend-file-manager-plugin-fixed-multipl...
Patch https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old...
Third Party Advisory https://www.wordfence.com/threat-intel/vulnerabilities/id/adb1d8b0-b1d6-40df-b59...
Exploit https://blog.nintechnet.com/wordpress-frontend-file-manager-plugin-fixed-multipl...
Patch https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old...
Third Party Advisory https://www.wordfence.com/threat-intel/vulnerabilities/id/adb1d8b0-b1d6-40df-b59...
47
/ 100
moderate-risk
Severity 33/34 · Critical
Exploitability 9/34 · Low
Exposure 5/34 · Minimal