Critical · published June 7, 2023
🚨 A crafty subscriber-level attacker can change plugin settings in WordPress with zero authorization checks in the Frontend File Manager plugin! 🔥 Think of this like a sneaky diner swapping out the ingredients on the chef's special without anyone noticing — they can change what’s being served without permission, potentially leading to disastrous consequences. If an attacker gains access, they could modify upload settings, allowing dangerous file types to be uploaded. This opens the door to remote code execution, which means they could run any code they want on your server — talk about a cybersecurity nightmare! 😱
Think of this like a sneaky diner swapping out the ingredients on the chef's special without anyone noticing — they can change what’s being served without permission, potentially leading to disastrous consequences. The vulnerability stems from the lack of capability checks and a security nonce on the 'wpfm_save_settings' AJAX action, allowing lower-level users to modify critical settings without proper authentication.
If an attacker gains access, they could modify upload settings, allowing dangerous file types to be uploaded. This opens the door to remote code execution, which means they could run any code they want on your server — talk about a cybersecurity nightmare! 😱 Update the Frontend File Manager plugin to version 18.3 or later immediately to close this security hole. Additionally, consider reviewing user permissions to restrict access for lower-level accounts. 🛡️ You’ve got this! With these steps, you’ll shore up your defenses in no time! ✨