Read the docs
TI-2022-02885 Aliases CVE-2022-3126GHSA-g5j9-cp6r-48pp

Frontend File Manager < 21.4 - File Upload via CSRF

Priority MEDIUM 53CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-352.

Summary

The Frontend File Manager Plugin WordPress plugin before 21.4 does not have CSRF check when uploading files, which could allow attackers to make logged in users upload files on their behalf

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00327 25th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Frontend File Manager Plugin (Unknown): 21.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownFrontend File Manager Plugin21.4 to before 21.421.4Patch availableCNA
  • Frontend File Manager Plugin VendorUnknown Affected 21.4 to before 21.4 Fixed in 21.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:najeebmedia:frontend_file_manager_plugin:*:*:*:*:*:wordpress:*:*before 21.4VulnerableNajeebmedia
  • cpe:2.3:a:najeebmedia:frontend_file_manager_plugin:*:*:*:*:*:wordpress:*:* Versions before 21.4 Vulnerable ·Najeebmedia

Remediation

  • Fix · CNA Frontend File Manager Plugin (Unknown) Fixed in 21.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-3126
  2. 2026-10-03 Alias added: GHSA-g5j9-cp6r-48pp

References

Exploit 1

  • TI-2021-03225 Frontend File Manager <= 18.2 - Authenticated Settings Change leading to Arbitrary File Upload CVSS 3.1CRITICAL 9.9
  • TI-2021-03213 Frontend File Manager <= 18.2 - Unauthenticated Arbitrary File Download CVSS 3.1CRITICAL 9.8
  • TI-2021-03222 Frontend File Manager <= 18.2 - Unauthenticated Stored Cross-Site Scripting CVSS 3.1HIGH 7.2
  • TI-2021-03207 Frontend File Manager <= 18.2 - Unauthenticated HTML Injection leading to Spam Emails CVSS 3.1HIGH 7.2
  • TI-2021-03216 Frontend File Manager Plugin <= 18.2 - Unauthenticated Arbitrary Post Deletion CVSS 3.1MEDIUM 6.5
  • TI-2021-03226 Frontend File Manager <= 18.2 - Unauthenticated Content Injection CVSS 3.1MEDIUM 5.8
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences