CVE-2016-15042: Frontend File Manager < 4.0 & N-Media Post Front-end Form < 1.1 & - Arbitrary File Upload
The Frontend File Manager (versions < 4.0), N-Media Post Front-end Form (versions < 1.1) plugins for WordPress are vulnerable to arbitrary file uploads due to missing file type validation via the nmfilemanageruploadfile and nmpostfrontuploadfile AJAX actions. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-15042?
CVE-2016-15042 is considered a moderate severity vulnerability due to its potential for arbitrary file uploads.
How do I fix CVE-2016-15042?
To fix CVE-2016-15042, update the N-Media Frontend File Manager plugin to version 4.0 or later and the N-Media Post Front-end Form plugin to version 1.1 or later.
Which versions are affected by CVE-2016-15042?
CVE-2016-15042 affects N-Media Frontend File Manager versions prior to 4.0 and N-Media Post Front-end Form versions prior to 1.1.
What type of vulnerability is represented by CVE-2016-15042?
CVE-2016-15042 represents an arbitrary file upload vulnerability due to inadequate file type validation.
Can CVE-2016-15042 lead to remote code execution?
Yes, CVE-2016-15042 can potentially lead to remote code execution if exploited appropriately.