Frontend File Manager < 4.0 & N-Media Post Front-end Form < 1.1 & - Arbitrary File Upload

Vulnerability

The arbitrary file upload vulnerability exists in the Frontend File Manager plugin (versions < 4.0) and the N-Media Post Front-end Form plugin (versions < 1.1) for WordPress. The flaw is due to missing file type validation in the nm_filemanager_upload_file and nm_postfront_upload_file AJAX actions, allowing unauthenticated attackers to upload arbitrary files to the server. [1][2]

Exploitation

An attacker can exploit this vulnerability by sending a crafted request to the affected AJAX actions without any authentication. No special network position or user interaction is required. The attacker simply uploads a malicious file (e.g., a PHP web shell) via the vulnerable upload functionality. [1][2]

Impact

Successful exploitation allows the attacker to upload arbitrary files, including executable code, which can lead to remote code execution. This could result in full compromise of the WordPress site, including data theft, defacement, or further escalation. The attacker may achieve the same privileges as the web server process. [1][2]

Mitigation

Updates are available: Frontend File Manager should be updated to version 4.0 or later [1], and N-Media Post Front-end Form should be updated to version 1.1 or later [2]. No workarounds are documented; the only mitigation is to apply the available patches. [2]