CVE-2016-15042

The Frontend File Manager (versions < 4.0), N-Media Post Front-end Form (versions < 1.1) plugins for WordPress are vulnerable to arbitrary file uploads due to missing file type validation via the `nm_filemanager_upload_file` and `nm_postfront_upload_file` AJAX actions. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

5.72% chance of exploitation in the next 30 days, 92th percentile

Nuclei

critical · CWE-434

Published

2024-10-16

Updated

2026-04-08

Proof-of-concept exploits (2)

• https://www.pluginvulnerabilities.com/2016/09/19/arbitrary-file-upload-vulnerability-in-f…
• https://www.pluginvulnerabilities.com/2016/09/19/arbitrary-file-upload-vulnerability-in-n…

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-15042.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2016-15041
• CVE-2016-15043
• CVE-2016-15038
• CVE-2016-15044
• CVE-2016-15003
• CVE-2016-15045