CVE-2022-3125 Frontend File Manager < 21.3 - Subscriber+ Arbitrary File Upload

2022-10-0313:45:26

CWE-434

WPScan

www.cve.org

frontend file manager

cve-2022-3125

arbitrary file upload

rce

wordpress plugin

8.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.0%

JSON

The Frontend File Manager Plugin WordPress plugin before 21.3 allows any authenticated users, such as subscriber, to rename a file to an arbitrary extension, like PHP, which could allow them to basically be able to upload arbitrary files on the server and achieve RCE

CNA Affected

[
  {
    "product": "Frontend File Manager Plugin",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "21.3",
        "status": "affected",
        "version": "21.3",
        "versionType": "custom"
      }
    ]
  }
]