CVE-2021-4351: Frontend File Manager <= 18.2 - Unauthenticated Post Meta Change
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Post Meta Change in versions up to, and including, 18.2. This is due to lacking authentication protections, capability checks, and sanitization, all on the wpfmfilemetaupdate AJAX action. This makes it possible for unauthenticated attackers to change the meta data of certain posts and pages.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-4351?
CVE-2021-4351 is a vulnerability in the Frontend File Manager plugin for WordPress that allows unauthenticated users to change post meta data.
What is the severity of CVE-2021-4351?
CVE-2021-4351 has a severity rating of 5.3 (medium).
How can CVE-2021-4351 be exploited?
CVE-2021-4351 can be exploited by unauthenticated users who can modify post meta data through the wpfm_file_meta_update AJAX action.
Which versions of the Frontend File Manager plugin for WordPress are affected by CVE-2021-4351?
Versions up to and including 18.2 of the Frontend File Manager plugin for WordPress are affected by CVE-2021-4351.
Are there any recommended security measures to mitigate CVE-2021-4351?
To mitigate CVE-2021-4351, it is recommended to update to the latest version of the Frontend File Manager plugin for WordPress as soon as it becomes available.