Vulnerability · Published Oct 3, 2022 · Assigned by WPScan
CVE-2022-3124Frontend File Manager < 21.3 - Unauthenticated File Renaming
Medium 5.3
In plain English
A medium-severity missing authorization in Frontend File Manager Plugin from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 8.3% (higher than 95% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS NVD)5.3Medium
Exploit odds (30 days)8.3%top 5.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei
Official description
The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack of validation in the destination filename, this could allow allow them to change the content of arbitrary files on the web server
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | wordpress | no fix listed | UBUNTU-CVE-2022-3124 |
| Ubuntu:24.04:LTS | wordpress | no fix listed | UBUNTU-CVE-2022-3124 |
| Ubuntu:25.10 | wordpress | no fix listed | UBUNTU-CVE-2022-3124 |
| Ubuntu:26.04:LTS | wordpress | no fix listed | UBUNTU-CVE-2022-3124 |
| Ubuntu:26.10 | wordpress | no fix listed | UBUNTU-CVE-2022-3124 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Frontend File Manager Plugin | 21.3 – before 21.3 |
Weakness: CWE-862