Skip to content
OpenAdvisories
Medium · 6.5 CVE-2022-2356 EUVD-2022-34624GHSA-r7g6-6vgc-xh4c

User Private Files < 1.1.3 - Subscriber+ Arbitrary File Upload

Published Aug 8, 2022 · Updated Jun 23, 2026 · Assigned by WPScan

Description

The Frontend File Manager & Sharing WordPress plugin before 1.1.3 does not filter file extensions when letting users upload files on the server, which may lead to malicious code being uploaded.

Affected products

VendorProductAffectedFixed
— Frontend File Manager & Sharing – User Private Files 1.1.3 – < 1.1.3 1.1.3

References