CVE-2021-4359
First published: Wed Jun 07 2023(Updated: )
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary Post Deletion in versions up to, and including, 18.2. This is due to lacking authentication protections and lacking a security nonce on the wpfm_delete_file AJAX action. This makes it possible for unauthenticated attackers to delete any posts and pages on the site.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| N-Media Frontend File Manager | <=18.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://blog.nintechnet.com/wordpress-frontend-file-manager-plugin-fixed-multiple-critical-vulnerabilities/
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2554359%40nmedia-user-file-uploader&new=2554359%40nmedia-user-file-uploader&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/84c61d00-20c1-4176-a74d-ea6ff6220f26?source=cve
Frequently Asked Questions
What is CVE-2021-4359?
CVE-2021-4359 is a vulnerability in the Frontend File Manager plugin for WordPress that allows unauthenticated users to delete posts on a vulnerable site.
What is the severity of CVE-2021-4359?
The severity of CVE-2021-4359 is medium with a CVSS score of 5.3.
How does CVE-2021-4359 affect the Frontend File Manager plugin?
CVE-2021-4359 affects the Frontend File Manager plugin by allowing unauthenticated users to delete posts without proper authentication and security nonce protection.
Which versions of the Frontend File Manager plugin are affected by CVE-2021-4359?
Versions up to and including 18.2 of the Frontend File Manager plugin are affected by CVE-2021-4359.
Is there a fix available for CVE-2021-4359?
Yes, there is a fix available for CVE-2021-4359. It is recommended to update to a version of the Frontend File Manager plugin that includes the necessary security fixes.
- agent/type
- agent/softwarecombine
- agent/references
- agent/weakness
- agent/severity
- agent/remedy
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/najeebmedia
- canonical/n-media frontend file manager
- version/n-media frontend file manager/18.2