Frontend File Manager < 21.3 - Subscriber+ Arbitrary File Upload
Priority MEDIUM 41CWE-434Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-434.
Summary
The Frontend File Manager Plugin WordPress plugin before 21.3 allows any authenticated users, such as subscriber, to rename a file to an arbitrary extension, like PHP, which could allow them to basically be able to upload arbitrary files on the server and achieve RCE
Why it matters now
EPSS 0.01643 76th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Frontend File Manager Plugin (Unknown): 21.3
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Frontend File Manager Plugin | 21.3 to before 21.3 | 21.3 | Patch available | CNA |
- Frontend File Manager Plugin VendorUnknown Affected 21.3 to before 21.3 Fixed in 21.3 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:najeebmedia:frontend_file_manager:*:*:*:*:*:wordpress:*:* | before 21.3 | Vulnerable | Najeebmedia |
- cpe:2.3:a:najeebmedia:frontend_file_manager:*:*:*:*:*:wordpress:*:* Versions before 21.3 Vulnerable ·Najeebmedia
Remediation
- Fix · CNA Frontend File Manager Plugin (Unknown) Fixed in 21.3
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Frontend File Manager Plugin 21.3
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2022-02883 Frontend File Manager < 21.3 - Unauthenticated File RenamingPriority LOW 35
Timeline
- 2026-10-02 Threatist record created from CVE-2022-3125
- 2026-10-03 Alias added: GHSA-q6gp-rjmw-h7qw
References
More Najeebmedia Frontend File Manager vulnerabilities
- TI-2016-09162 Frontend File Manager < 4.0 & N-Media Post Front-end Form < 1.1 & - Arbitrary File Upload CVSS 3.1CRITICAL 9.8
- TI-2024-17003 WordPress Frontend File Manager Plugin plugin <= 22.7 - Sensitive Data Exposure vulnerability CVSS 3.1HIGH 7.5
- TI-2022-02883 Frontend File Manager < 21.3 - Unauthenticated File Renaming CVSS 3.1MEDIUM 5.3
Sources
- CVE-2022-3125 · CVE Program
- CVE-2022-3125 · NVD
- FIRST EPSS
- GHSA-q6gp-rjmw-h7qw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences