CVE-2022-3125

What it actually does

The flaw permits any authenticated user to rename uploaded files to arbitrary extensions such as .php, bypassing extension validation and enabling execution of attacker-supplied code via the web server.

Why it matters to the business

Compromised sites can be used for data theft, defacement, malware distribution, or lateral movement; the plugin's presence on many WordPress installations raises the chance of widespread server takeovers even years after disclosure.

How an attack unfolds

An attacker registers or obtains a low-privilege account, uploads a file with a benign extension, invokes the rename function to change the extension to .php, then requests the resulting file URL to trigger remote code execution.

How to fix it

Upgrade the Frontend File Manager plugin to version 21.3 or newer to enforce proper extension validation on rename operations; until updated, disable the plugin or restrict its use to administrator accounts only.

How to confirm the fix worked

Confirm the installed plugin version is at least 21.3, attempt a rename to a .php extension under a test subscriber account and verify the operation is rejected, and scan upload directories for unexpected executable files.

Typical attack path

1. Obtain authenticated session as subscriber or equivalent role
2. Upload a file containing malicious PHP code using the plugin's upload feature
3. Call the rename endpoint to alter the file extension to .php
4. Browse to the new file path to execute the payload

How to detect it

Search web-server access logs for POST requests to the plugin's rename handler followed by GET requests to newly created .php files in upload paths; inspect file-system timestamps for PHP files appearing in user-writable directories.

• /wp-content/uploads/frontend-file-manager/
• rename_file
• .php extension change
• POST /wp-admin/admin-ajax.php?action=nfm_rename

What your security team should do

• Inventory all WordPress sites for the Frontend File Manager plugin and apply the 21.3+ update immediately
• Reduce the plugin's role-based permissions to the minimum necessary
• Add WAF rules blocking requests that attempt to rename files to executable extensions
• Enable file-integrity monitoring on upload directories