Frontend File Manager Plugin, 0b45c0e6c3017015881cc2ee8e9e2e10a5a6b2cd

CVE, Research URL: 0b45c0e6c3017015881cc2ee8e9e2e10a5a6b2cd
Home page URL: Security reports for Frontend File Manager Plugin
Application: Frontend File Manager Plugin
Published on: Sep 06, 2022
Research Description: Frontend File Manager Plugin [nmedia-user-file-uploader] < 21.3 Frontend File Manager <= 21.3 - Cross-Site Request Forgery to Plugin Settings Update The Frontend File Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 21.3. This is due to missing or incorrect nonce validation on the wpfm_save_settings function. This makes it possible for unauthenticated attackers to modify the plugin's settings, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected versions: max 21.3.
Status: vulnerable