What is CVE-2021-4351?

CVE-2021-4351 is a vulnerability in the Frontend File Manager plugin for WordPress that allows unauthenticated users to change post meta data.

What is the severity of CVE-2021-4351?

CVE-2021-4351 has a severity rating of 5.3 (medium).

How can CVE-2021-4351 be exploited?

CVE-2021-4351 can be exploited by unauthenticated users who can modify post meta data through the wpfm_file_meta_update AJAX action.

Which versions of the Frontend File Manager plugin for WordPress are affected by CVE-2021-4351?

Versions up to and including 18.2 of the Frontend File Manager plugin for WordPress are affected by CVE-2021-4351.

Are there any recommended security measures to mitigate CVE-2021-4351?

To mitigate CVE-2021-4351, it is recommended to update to the latest version of the Frontend File Manager plugin for WordPress as soon as it becomes available.

Vulnerability/
CVE-2021-4351

medium

5.8

CWE

862

7/6/2023

28/12/2024

CVE-2021-4351

First published: Wed Jun 07 2023(Updated: )

The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Post Meta Change in versions up to, and including, 18.2. This is due to lacking authentication protections, capability checks, and sanitization, all on the wpfm_file_meta_update AJAX action. This makes it possible for unauthenticated attackers to change the meta data of certain posts and pages.

Credit: security@wordfence.com

Affected Software	Affected Version	How to fix
N-Media Frontend File Manager	<=18.2

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is CVE-2021-4351?
CVE-2021-4351 is a vulnerability in the Frontend File Manager plugin for WordPress that allows unauthenticated users to change post meta data.
What is the severity of CVE-2021-4351?
CVE-2021-4351 has a severity rating of 5.3 (medium).
How can CVE-2021-4351 be exploited?
CVE-2021-4351 can be exploited by unauthenticated users who can modify post meta data through the wpfm_file_meta_update AJAX action.
Which versions of the Frontend File Manager plugin for WordPress are affected by CVE-2021-4351?
Versions up to and including 18.2 of the Frontend File Manager plugin for WordPress are affected by CVE-2021-4351.
Are there any recommended security measures to mitigate CVE-2021-4351?
To mitigate CVE-2021-4351, it is recommended to update to the latest version of the Frontend File Manager plugin for WordPress as soon as it becomes available.

agent/references
agent/type
agent/softwarecombine
agent/weakness
agent/severity
agent/author
agent/description
agent/first-publish-date
agent/event
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/source
agent/tags
collector/nvd-index
agent/software-canonical-lookup-request
vendor/najeebmedia
canonical/n-media frontend file manager
version/n-media frontend file manager/18.2

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.