Frontend File Manager & Sharing – User Private Files <= 1.1.2 - Subscriber+ Arbitrary File Upload

The Frontend File Manager & Sharing – User Private Files plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload_doc_callback function in versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with Subscriber level permissions and above, to upload arbitrary files on the affected sites server which may make remote code execution possible under certain conditions. The plugin adds a Rewrite Rule to the site's .htaccess file in order to ensure that direct file access is not possible. However, deactivation of the plugin or resetting of the .htaccess file would lead to potential for Remote Code Execution. Servers other than Apache may ignore .htaccess files and be vulnerable to RCE.

The attempt arrives as an ordinary request to User Private Files: WordSec's web application firewall inspects request payloads before WordPress loads them. Classes like this one can leave something behind, so the staged malware scanner is the second half: it looks for dropped files and modified code rather than for the request that created them. None of that substitutes for the fix: User Private Files 1.1.3 closes this, and updating the plugin is the step that ends it.

• Firewall
• Scanner
• Alerts