CVE-2022-3125

HIGH EXPLOITED

Frontend File Manager Plugin < 21.3 - Authenticated Arbitrary File Upload and Remote Code Execution via File Renaming

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2022-3125 has been observed exploited in the wild (reported by VulnCheck KEV).

Description

The Frontend File Manager Plugin WordPress plugin before 21.3 allows any authenticated users, such as subscriber, to rename a file to an arbitrary extension, like PHP, which could allow them to basically be able to upload arbitrary files on the server and achieve RCE

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/d3d9dc9a-226b-4f76-995e-e2af1dd6b17e

Scores

CVSS v3 8.8
EPSS 0.0111
EPSS Percentile 61.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

VulnCheck KEV 2022-09-07
CWE
CWE-434
Status published
Products (1)
najeebmedia/frontend_file_manager < 21.3
Published Oct 03, 2022
Tracked Since Feb 18, 2026