CVE-2021-4368 – The Frontend File Manager WordPress plugin up t... (How to Fix)

Q: What is the severity of CVE-2021-4368?

CVE-2021-4368 has a CVSS score of 9.9 (CRITICAL). The Frontend File Manager WordPress plugin up to version 18.2 has an authenticated settings change vulnerability. Subscriber-level attackers can modify plugin settings like allowed file types, potentially leading to remote code execution. This affects WordPress sites using vulnerable versions of the plugin.

📋 TL;DR

The Frontend File Manager WordPress plugin up to version 18.2 has an authenticated settings change vulnerability. Subscriber-level attackers can modify plugin settings like allowed file types, potentially leading to remote code execution. This affects WordPress sites using vulnerable versions of the plugin.

💻 Affected Systems

Products:

WordPress Frontend File Manager plugin

Versions: Versions up to and including 18.2

Operating Systems: All

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress installation with vulnerable plugin version and at least one subscriber account.

📦 What is this software?

Frontend File Manager Plugin by Najeebmedia

View all CVEs affecting Frontend File Manager Plugin →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution leading to complete site compromise, data theft, malware distribution, or site defacement.

🟠

Likely Case

Attackers upload malicious files to execute code, install backdoors, or modify site functionality.

🟢

If Mitigated

Limited to subscriber account compromise if proper access controls and file upload restrictions are in place.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated subscriber access. Public exploit details exist in security advisories.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Version 18.3 or later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2554359%40nmedia-user-file-uploader&new=2554359%40nmedia-user-file-uploader

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Frontend File Manager. 4. Click 'Update Now' if available. 5. Alternatively, download version 18.3+ from WordPress repository and manually update.

🔧 Temporary Workarounds

Disable vulnerable AJAX endpoint

all

Remove or restrict access to the wpfm_save_settings AJAX action

Add to theme functions.php or custom plugin: remove_action('wp_ajax_wpfm_save_settings', 'wpfm_save_settings'); remove_action('wp_ajax_nopriv_wpfm_save_settings', 'wpfm_save_settings');

Temporarily disable plugin

linux

Deactivate Frontend File Manager plugin until patched

wp plugin deactivate nmedia-user-file-uploader

🧯 If You Can't Patch

Restrict subscriber account creation and review existing subscriber accounts
Implement web application firewall rules to block suspicious AJAX requests to wpfm_save_settings

🔍 How to Verify

Check if Vulnerable:

Check plugin version in WordPress admin under Plugins > Installed Plugins. Version 18.2 or lower is vulnerable.

Check Version:

wp plugin get nmedia-user-file-uploader --field=version

Verify Fix Applied:

Confirm plugin version is 18.3 or higher. Test if subscriber accounts can modify plugin settings.

📡 Detection & Monitoring

Log Indicators:

POST requests to /wp-admin/admin-ajax.php with action=wpfm_save_settings from subscriber accounts
Unusual file uploads or settings changes in plugin logs

Network Indicators:

AJAX requests to wpfm_save_settings endpoint from unauthorized IPs

SIEM Query:

source="wordpress.log" AND "admin-ajax.php" AND "wpfm_save_settings"

📊 Metadata

CVE ID: CVE-2021-4368

CVSS v3 Score: 9.9 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE: CWE-862

Published: June 7, 2023

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-4368, you might also want to check these: