CVE-2021-4356
First published: Wed Jun 07 2023(Updated: )
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Download in versions up to, and including, 18.2. This is due to lacking authentication protections, capability checks, and sanitization, all on the wpfm_file_meta_update AJAX action. This makes it possible for unauthenticated attackers to download arbitrary files on the site, potentially leading to site takeover.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| N-Media Frontend File Manager | <=18.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://blog.nintechnet.com/wordpress-frontend-file-manager-plugin-fixed-multiple-critical-vulnerabilities/
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2554359%40nmedia-user-file-uploader&new=2554359%40nmedia-user-file-uploader&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/79e2011c-5e4d-4d02-831f-6b4dcfcaa51e?source=cve
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-4356.
What is the severity level of CVE-2021-4356?
The severity level of CVE-2021-4356 is critical with a severity value of 9.8.
Which software is affected by CVE-2021-4356?
The Frontend File Manager plugin for WordPress is affected by CVE-2021-4356.
What is the cause of CVE-2021-4356?
The cause of CVE-2021-4356 is lacking authentication protections, capability checks, and sanitization on the wpfm_file_meta_update AJAX action in the Frontend File Manager plugin for WordPress.
How can I fix CVE-2021-4356?
To fix CVE-2021-4356, update to a version of the Frontend File Manager plugin for WordPress that is higher than 18.2.
- agent/type
- agent/softwarecombine
- agent/references
- agent/weakness
- agent/severity
- agent/remedy
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/najeebmedia
- canonical/n-media frontend file manager
- version/n-media frontend file manager/18.2