Frontend File Manager Plugin, b86e5b52b92d2fd20064b61e72a3b83b501ffc63

CVE, Research URL: b86e5b52b92d2fd20064b61e72a3b83b501ffc63
Home page URL: Security reports for Frontend File Manager Plugin
Application: Frontend File Manager Plugin
Published on: Jul 12, 2021
Research Description: Frontend File Manager Plugin [nmedia-user-file-uploader] < 18.3 Frontend File Manager <= 18.2 - Unauthenticated Content Injection The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Content Injection in versions up to, and including, 18.2. This is due to lacking authorization protections, checks against users editing other's posts, and lacking a security nonce, all on the wpfm_edit_file_title_desc AJAX action. This makes it possible for unauthenticated attackers to edit the content and title of every page on the site.
Affected versions: max 18.3.
Status: vulnerable