CVE-2022-3124

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack of validation in the destination filename, this could allow allow them to change the content of arbitrary files on the web server

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Unknown	Frontend File Manager Plugin	>= 21.3, < 21.3

References

https://wpscan.com/vulnerability/00f76765-95af-4dbc-8c37-f1b15a0e8608Exploit, Third Party Advisory
https://wpscan.com/vulnerability/00f76765-95af-4dbc-8c37-f1b15a0e8608Exploit, Third Party Advisory

Timeline

Published: Oct 3, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-312436.4Update description and links DMA transactions which are targeted at input buffers used for the software SMI handler used by the FvbServicesR CVE-2022-312447.8Nokia OneNDS 17r2 has Insecure Permissions vulnerability that allows for privilege escalation.CVE-2022-312458.8mailcow before 2022-05d allows a remote authenticated user to inject OS commands and escalate privileges to domain admin via the --debug opt CVE-2022-312465.5paymentrequest.py in Electrum before 4.2.2 allows a file:// URL in the r parameter of a payment request (e.g., within QR code data). On Wind CVE-2022-312479.1An Improper Authorization vulnerability in SUSE Rancher, allows any user who has permissions to create/edit cluster role template bindings o CVE-2022-312485.3A Observable Response Discrepancy vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attacker CVE-2022-312499.8A Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in wrangler of SUSE Rancher allow CVE-2022-31258.8The Frontend File Manager Plugin WordPress plugin before 21.3 allows any authenticated users, such as subscriber, to rename a file to an arb CVE-2022-312507.8A UNIX Symbolic Link (Symlink) Following vulnerability in keylime of openSUSE Tumbleweed allows local attackers to escalate from the keylime CVE-2022-312516.3A Incorrect Default Permissions vulnerability in the packaging of the slurm testsuite of openSUSE Factory allows local attackers with contro CVE-2022-312524.4A Incorrect Authorization vulnerability in chkstat of SUSE Linux Enterprise Server 12-SP5; openSUSE Leap 15.3, openSUSE Leap 15.4, openSUSE CVE-2022-312537.8A Untrusted Search Path vulnerability in openldap2 of openSUSE Factory allows local attackers with control of the ldap user or group to chan