CVE-2021-4365 – This vulnerability allows unauthenticated attac... (How to Fix)

Q: What is the severity of CVE-2021-4365?

CVE-2021-4365 has a CVSS score of 7.2 (HIGH). This vulnerability allows unauthenticated attackers to inject malicious scripts into WordPress sites using the Frontend File Manager plugin. When users visit compromised pages, the scripts execute in their browsers, potentially stealing credentials or performing unauthorized actions. All WordPress sites running vulnerable plugin versions are affected.

📋 TL;DR

This vulnerability allows unauthenticated attackers to inject malicious scripts into WordPress sites using the Frontend File Manager plugin. When users visit compromised pages, the scripts execute in their browsers, potentially stealing credentials or performing unauthorized actions. All WordPress sites running vulnerable plugin versions are affected.

💻 Affected Systems

Products:

WordPress Frontend File Manager plugin

Versions: All versions up to and including 18.2

Operating Systems: All operating systems running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Any WordPress site with the vulnerable plugin installed and activated is affected regardless of configuration.

📦 What is this software?

Frontend File Manager Plugin by Najeebmedia

View all CVEs affecting Frontend File Manager Plugin →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could steal administrator credentials, take over the WordPress site, deface pages, or redirect visitors to malicious sites, leading to complete site compromise and data theft.

🟠

Likely Case

Attackers inject malicious scripts to steal user session cookies, redirect users to phishing pages, or display unwanted advertisements, compromising user trust and site integrity.

🟢

If Mitigated

With proper input validation and output encoding, script injection would be prevented, limiting impact to minor data display issues without code execution.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

The vulnerability requires no authentication and exploitation is straightforward via crafted AJAX requests.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Version 18.3 or later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2554359%40nmedia-user-file-uploader&new=2554359%40nmedia-user-file-uploader&sfp_email=&sfph_mail=

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Frontend File Manager' and click 'Update Now'. 4. Verify plugin version is 18.3 or higher.

🔧 Temporary Workarounds

Disable vulnerable AJAX endpoint

all

Remove or restrict access to the wpfm_edit_file_title_desc AJAX action to prevent exploitation.

Add to theme's functions.php: remove_action('wp_ajax_wpfm_edit_file_title_desc', 'wpfm_edit_file_title_desc');
Add to theme's functions.php: remove_action('wp_ajax_nopriv_wpfm_edit_file_title_desc', 'wpfm_edit_file_title_desc');

Disable plugin

linux

Temporarily deactivate the Frontend File Manager plugin until patched.

wp plugin deactivate nmedia-user-file-uploader

🧯 If You Can't Patch

Implement a Web Application Firewall (WAF) with XSS protection rules to block malicious payloads.
Apply strict Content Security Policy (CSP) headers to prevent script execution from unauthorized sources.

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Installed Plugins for 'Frontend File Manager'. If version is 18.2 or lower, the site is vulnerable.

Check Version:

wp plugin get nmedia-user-file-uploader --field=version

Verify Fix Applied:

After updating, confirm plugin version shows 18.3 or higher in WordPress admin plugins list.

📡 Detection & Monitoring

Log Indicators:

Unusual POST requests to /wp-admin/admin-ajax.php with action=wpfm_edit_file_title_desc containing script tags or JavaScript code
Multiple failed AJAX requests from unauthenticated users

Network Indicators:

HTTP requests with malicious payloads in parameters targeting the vulnerable endpoint
Unexpected script tags in page responses from the WordPress site

SIEM Query:

source="*access.log*" AND "admin-ajax.php" AND "wpfm_edit_file_title_desc" AND ("<script>" OR "javascript:" OR "onerror=" OR "onload=")

📊 Metadata

CVE ID: CVE-2021-4365

CVSS v3 Score: 7.2 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

CWE: CWE-79

Published: June 7, 2023

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-4365, you might also want to check these: