Authentication flaw

2023-06-0702:15:00

PRIOn knowledge base

www.prio-n.com

wordpress

authentication

vulnerability

ajax

attackers

plugin

5.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

47.3%

JSON

The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Post Meta Change in versions up to, and including, 18.2. This is due to lacking authentication protections, capability checks, and sanitization, all on the wpfm_file_meta_update AJAX action. This makes it possible for unauthenticated attackers to change the meta data of certain posts and pages.

CPENameOperatorVersion
frontend_file_manager_pluginle18.2

CPE	Name	Operator	Version
	frontend_file_manager_plugin	le	18.2

References

blog.nintechnet.com/wordpress-frontend-file-manager-plugin-fixed-multiple-critical-vulnerabilities/

www.wordfence.com/threat-intel/vulnerabilities/id/5539aa79-66ad-43fa-967c-2bec877061e0?source=cve