CyberRota Analysis
AI-GeneratedThe Frontend File Manager Plugin for WordPress versions up to 23.6 is vulnerable due to a lack of nonce validation in its file-metadata update action, enabling attackers to exploit this flaw through CSRF attacks. This can allow unauthorized modification of file metadata, potentially leading to unauthorized file downloads, especially if guest uploads are enabled. WordPress site administrators using this plugin should prioritize addressing this vulnerability to protect user-uploaded files from unauthorized access.
Original NVD Description
The Frontend File Manager Plugin WordPress plugin through 23.6 does not perform nonce validation on one of its file-metadata update actions, allowing an attacker to modify the metadata of a logged-in user's uploaded file via a CSRF attack, which can be leveraged to download that file. When guest uploads are enabled, the same action is reachable unauthenticated against any user's file.