CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Frontend File Manager Plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 23.4. This is due to the plugin not validating file ownership before processing file rename requests in the '/wpfm/v1/file-rename' REST API endpoint. This makes it possible for authenticated attackers, with Subscriber-level access and above, to rename files uploaded by other users via the 'fileid' parameter.
Explanation of Vulnerability in Simple Terms
The Frontend File Manager Plugin for WordPress versions 23.4 and earlier contains an authorization flaw that allows authenticated users to modify files they should not have access to. An attacker with a low-privilege account can alter file contents through the plugin's interface. The vulnerability requires valid login credentials but no additional user interaction. Update to a version newer than 23.4.
What an attacker can do
Modify files on the site through the plugin interface with a low-privilege account.
Potential impact on your site
Authenticated users can alter site files beyond their intended permissions, risking content corruption or malicious modifications.
Conditions required to exploit
Attacker must have a valid WordPress user account with low-level privileges.
Key dates
External resources
