CVE-2016-15042

CRITICO 9.8CVE-2016-15042 · Published 16/10/2024 · updated 17/06/2026

In breve

CVE-2016-15042 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda frontend file manager (najeebmedia), post front-end form (najeebmedia).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 6.7%, superiore al 93.9% delle vulnerabilità.
Correzione: aggiornare a 4.0, 1.1 o successiva.

Package	Affected versions	Patched versions
frontend file manager najeebmedia	`< 4.0`	`4.0`
post front-end form najeebmedia	`< 1.1`	`1.1`

Description

The Frontend File Manager (versions < 4.0), N-Media Post Front-end Form (versions < 1.1) plugins for WordPress are vulnerable to arbitrary file uploads due to missing file type validation via the `nm_filemanager_upload_file` and `nm_postfront_upload_file` AJAX actions. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

References

wordpress.org/plugins/nmedia-user-file-uploader · Product
wpscan.com/vulnerability/052f7d9a-aaff-4fb1-92b7-aeb83cc705a7 · Third Party Advisory
acunetix.com/vulnerabilities/web/wordpress-plugin-n-media-post-front-end-form-arbitrary-file-upload-1-0 · Third Party Advisory
pluginvulnerabilities.com/2016/09/19/arbitrary-file-upload-vulnerability-in-front-end-file-upload-and-manager-plugin · Exploit
pluginvulnerabilities.com/2016/09/19/arbitrary-file-upload-vulnerability-in-n-media-post-front-end-form · Exploit
wordfence.com/threat-intel/vulnerabilities/id/2c1e6298-f243-49a5-b1b7-52bd6a6c8858 · Third Party Advisory

Altre vulnerabilità di frontend file manager

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free