Frontend File Manager < 21.3 - Unauthenticated File Renaming
CVE-2022-3124
Verified
Description
The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack of validation in the destination filename, this could allow allow them to change the content of arbitrary files on the web server
Severity
Medium
CVSS Score
5.3
Exploit Probability
8%
Affected Product
frontend_file_manager
Published Date
September 16, 2025
Template Author
riteshs4hu
CVE-2022-3124.yaml
5.3Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVE ID:
cve-2022-3124
CWE ID:
cwe-862
Remediation Steps
Update Frontend File Manager plugin to version 21.3 or later that validates file rename operations and restricts them to authenticated users with proper path validation.