Frontend File Manager < 21.3 - Subscriber+ Arbitrary File Upload

The plugin allows any authenticated users, such as subscriber, to rename a file to an arbitrary extension, like PHP, which could allow them to basically be able to upload arbitrary files on the server and achieve RCE

PoC

1. Navigate to the page where [ffmwp] shortcode is included as Subscriber 2. Upload the malicious PHP file as PDF file (e.g., exploit.pdf) 3. View the file and rename it from exploit.pdf to exploit.php The file will be accessible via https://example.com/wp-content/uploads/user_uploads//exploit.php