WordPress Plugin Vulnerabilities
Frontend File Manager < 22.7 - Editor+ Arbitrary File Download
Description
The plugin has a vulnerability that allows an Editor+ user to bypass the file download logic and download files such as `wp-config.php`
Proof of Concept
1) Create new post with this shortcode - [ffmwp] 2) Go to new post and upload any file 3) After that go to main page of plugin for users http://your_site/wordpress/wp-admin/edit.php?post_type=wpfm-files 4) Click to "Edit" button 5) Change wpfm_dir_path and wpfm_file_url to /var/www/html/wordpress/wp-config.php 6) Go back to the main page http://your_site/wordpress/wp-admin/edit.php?post_type=wpfm-files and click "Download"
Affects Plugins
Fixed in 22.7 References
Classification
Type
TRAVERSAL
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Dmitrii Ignatyev
Submitter
Dmitrii Ignatyev
Submitter website
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2023-11-13 (about 6 months ago)
Added
2023-11-13 (about 6 months ago)
Last Updated
2023-11-29 (about 5 months ago)
WPScan 