Unauthenticated Content Injection in Frontend File Manager Plugin for WordPress

CVE-2021-4369

Summary

The Frontend File Manager plugin for WordPress, up to version 18.2, is susceptible to unauthenticated content injection vulnerabilities. Due to insufficient authorization checks and the absence of security nonce in the wpfm_edit_file_title_desc AJAX action, unauthorized users can potentially alter the content and titles of pages across the site. This security gap poses significant risks, allowing attackers to modify site information without needing to authenticate.

References