PT-2025-48007 · WordPress · Frontend File Manager Plugin

Rajesh Singh · Published 2025-11-25 · Updated 2025-11-25 · CVE-2025-13382

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Frontend File Manager Plugin for WordPress versions prior to 23.4

Description The plugin does not validate file ownership before processing file rename requests. This allows authenticated attackers with Subscriber-level access or higher to rename files uploaded by other users. The issue is present in the '/wpfm/v1/file-rename' API endpoint, where the fileid parameter is used without proper validation.

Recommendations Update the Frontend File Manager Plugin for WordPress to version 23.4 or later.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-13382

Affected Products

Frontend File Manager Plugin

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-13382 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/aa8d5feb-2ae9-44b8-90b5-9fc67226855a?source=cve · Note
• https://plugins.trac.wordpress.org/browser/nmedia-user-file-uploader/tags/23.4/inc/classes/class.rest.php#L20 · Note
• https://plugins.trac.wordpress.org/browser/nmedia-user-file-uploader/tags/23.5/inc/classes/class.rest.php#L20 · Note
• https://twitter.com/VulmonFeeds/status/1993291791739523375 · Twitter Post
• https://plugins.trac.wordpress.org/browser/nmedia-user-file-uploader/tags/23.4/inc/classes/class.rest.php#L52 · Note
• https://t.me/CVEtracker/38170 · Telegram Post
• https://twitter.com/CVEnew/status/1993225825421083121 · Twitter Post