CVE-2022-3126 Frontend File Manager < 21.4 - File Upload via CSRF
Attackers can trick logged-in users into uploading files via CSRF in the Frontend File Manager WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-3126?
CVE-2022-3126 is a medium-severity vulnerability in Unknown Frontend File Manager Plugin, published on 17 Oct 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Frontend File Manager Plugin WordPress plugin before 21.4 does not have CSRF check when uploading files, which could allow attackers to make logged in users upload files on their behalf
Weakness: CWE-352
Which versions are affected by CVE-2022-3126?
It affects 1 product.
Products include Najeebmedia Frontend File Manager Plugin.
How do I fix CVE-2022-3126?
No fix has been published for CVE-2022-3126 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-3126 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-3126 exists.
Other vulnerabilities in Unknown Frontend File Manager Plugin
- CVE-2021-4368 Frontend File Manager <= 18.2 - Authenticated Settings Change leading to Arbitrary File Upload
- CVE-2021-4356 Frontend File Manager <= 18.2 - Unauthenticated Arbitrary File Download
- CVE-2021-4350 Frontend File Manager <= 18.2 - Unauthenticated HTML Injection leading to Spam Emails
- CVE-2021-4365 Frontend File Manager <= 18.2 - Unauthenticated Stored Cross-Site Scripting
- CVE-2023-5105 Frontend File Manager < 22.6 - Editor+ Arbitrary File Download
Sources
Also known as GHSA-g5j9-cp6r-48pp.