PT-2022-20633 · WordPress · Frontend File Manager Plugin

Raad Haddad · Published 2022-10-03 · Updated 2026-06-07 · CVE-2022-3124

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Frontend File Manager Plugin WordPress plugin versions prior to 21.3

Description The issue allows any unauthenticated user to rename uploaded files from users. Due to the lack of validation in the destination filename, this could allow them to change the content of arbitrary files on the web server.

Recommendations For versions prior to 21.3, update to version 21.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the file upload and rename functionality to authenticated users only. Avoid using the file rename feature until the issue is resolved.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-3124

Affected Products

Frontend File Manager Plugin

References · 7

• 🔥 https://wpscan.com/vulnerability/00f76765-95af-4dbc-8c37-f1b15a0e8608 · Exploit
• https://ubuntu.com/security/CVE-2022-3124 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3124 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-3124 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-3124 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-3124 · Vendor Advisory
• https://twitter.com/pdnuclei_bot/status/2063605286439702549 · Twitter Post