CVE-2022-3126: medium-severity vulnerability in Frontend File Manager Plugin
Frontend File Manager < 21.4 - File Upload via CSRF
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.3epss 0.3%
The Frontend File Manager Plugin WordPress plugin before 21.4 does not have CSRF check when uploading files, which could allow attackers to make logged in users upload files on their behalf
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected products
Unknown · Frontend File Manager PluginRelated CVEs — Frontend File Manager Plugin
In the same product, most dangerous first.
CVE-2022-3124—Frontend File Manager < 21.3 - Unauthenticated File RenamingEPSS 8.3%CVE-2022-3125—Frontend File Manager < 21.3 - Subscriber+ Arbitrary File UploadEPSS 1.6%CVE-2023-5105—Frontend File Manager < 22.6 - Editor+ Arbitrary File DownloadEPSS 1.0%CVE-2026-0829MEDIUMFrontend File Manager Plugin <= 23.5 - Unauthenticated Arbitrary Email SendingEPSS 0.7%CVE-2026-8380MEDIUMFrontend File Manager Plugin <= 23.6 - Author+ Arbitrary Post DeletionEPSS 0.5%CVE-2026-8379HIGHFrontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File DownloadEPSS 0.4%