The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated HTML Injection in versions up to, and including, 18.2. This is due to lacking authentication protections on the wpfm_send_file_in_email AJAX action. This makes it possible for unauthenticated attackers to send emails using the site with a custom subject, recipient email, and body with unsanitized HTML content. This effectively lets the attacker use the site as a spam relay.
References
Configurations
History
21 Nov 2024, 06:37
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://blog.nintechnet.com/wordpress-frontend-file-manager-plugin-fixed-multiple-critical-vulnerabilities/ - Exploit | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/49150180-9de0-4318-b21b-779daaeb7a52?source=cve - Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.2 |
13 Jun 2023, 16:22
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
| First Time |
Najeebmedia
Najeebmedia frontend File Manager Plugin |
|
| References | (MISC) https://www.wordfence.com/threat-intel/vulnerabilities/id/49150180-9de0-4318-b21b-779daaeb7a52?source=cve - Third Party Advisory | |
| References | (MISC) https://blog.nintechnet.com/wordpress-frontend-file-manager-plugin-fixed-multiple-critical-vulnerabilities/ - Exploit | |
| CWE | CWE-862 | |
| CPE | cpe:2.3:a:najeebmedia:frontend_file_manager_plugin:*:*:*:*:*:wordpress:*:* |
07 Jun 2023, 02:44
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-07 02:15
Updated : 2024-11-21 06:37
NVD link : CVE-2021-4350
Mitre link : CVE-2021-4350
CVE.ORG link : CVE-2021-4350
JSON object : View
Products Affected
najeebmedia
- frontend_file_manager_plugin
CWE
CWE-862
Missing Authorization