vulnwire
9.8crit

CVE-2016-15042Nuclei template

Frontend File Manager < 4.0 & N-Media Post Front-end Form < 1.1 & - Arbitrary File Upload

Published 2 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
6.7%
percentile 94%
Public exploits
0
none known · Nuclei check

The Frontend File Manager (versions < 4.0), N-Media Post Front-end Form (versions < 1.1) plugins for WordPress are vulnerable to arbitrary file uploads due to missing file type validation via the `nm_filemanager_upload_file` and `nm_postfront_upload_file` AJAX actions. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

CISA SSVC assessment

Exploitation
Proof of concept public
Automatable
yes
Technical impact
total
Assessed
2 y ago

Exploit prediction (EPSS)

6.68% probability of exploitation in the next 30 days, higher than 94% of all scored CVEs.

Exploits and detections

  • Nuclei template WordPress Frontend File Manager < 4.0 & N-Media Post Frontend < 1.1 - Arbitrary File Upload · nuclei detection template

CVSS scores

Assigned byVersionScoreVector
CNA3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • nmedia N-Media Post Front-end Form
  • nmedia Frontend File Manager Plugin
  • najeebmedia frontend_file_manager
  • najeebmedia n-media_post_front-end_form

Classification

Weakness
  • CWE-434 Unrestricted Upload of File with Dangerous Type

References

  • wordfence.com /threat-intel/vulnerabilities/id/2c1e6298-f243-49a5-b1b7-52bd6a6c8858?source=cve
  • pluginvulnerabilities.com /2016/09/19/arbitrary-file-upload-vulnerability-in-front-end-file-upload-and-manager-plugi
  • wordpress.org /plugins/nmedia-user-file-uploader/#developers
  • wpscan.com /vulnerability/052f7d9a-aaff-4fb1-92b7-aeb83cc705a7
  • pluginvulnerabilities.com /2016/09/19/arbitrary-file-upload-vulnerability-in-n-media-post-front-end-form/
  • acunetix.com /vulnerabilities/web/wordpress-plugin-n-media-post-front-end-form-arbitrary-file-upload-1-

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.