Technical impact
The Frontend File Manager Plugin for WordPress contains an insecure direct object reference in the REST API endpoint '/wpfm/v1/file-rename'. This flaw permits authenticated users with Subscriber level or higher access to rename any file belonging to another user by specifying its identifier. The result is a form of privilege abuse that can be used to manipulate file names, potentially obfuscate malicious files, overwrite or hide important data, or facilitate further exploitation if file names are part of configuration or referencing mechanisms. The weakness is classified as CWE-639, reflecting improper access control over resources. The overall security impact is moderate; the vulnerability does not lead directly to code execution but can undermine the integrity of user data and complicate system administration.
Affected Systems
Affected systems are WordPress installations that have the nmedia Frontend File Manager Plugin installed in any version up through 23.4 inclusive. The vulnerable versions include all releases prior to 23.5, where the intended fix was applied. Administrators should verify whether their site runs any of these earlier versions.
Risk and Exploitability
The CVSS score for this vulnerability is 4.3, indicating moderate risk. The EPSS score is less than 1%, suggesting a very low exploitation probability at present. The issue is not listed in the CISA KEV catalog. Exploitation requires that the attacker be authenticated under a role of Subscriber or higher, which is typically a regular WordPress user. The attacker can trigger the rename by sending a request to the API endpoint and providing a valid file identifier that does not belong to them. Because the plugin does not validate ownership before processing the rename, the action succeeds and the targeted file is renamed. Despite the mild severity, the presence of this flaw can create a foothold for more serious attacks or disrupt normal operations if file names are relied upon by other components. The attacker’s capability is limited to renaming, with no direct privilege escalation, but the potential for deception or confusion makes it a notable security concern.
