{"id":"CVE-2016-15042","aliases":["EUVD-2016-10786","GHSA-98v8-mh4j-wqg7"],"status":"published","title":"Frontend File Manager \u003c 4.0 \u0026 N-Media Post Front-end Form \u003c 1.1 \u0026 - Arbitrary File Upload","description":"The Frontend File Manager (versions \u003c 4.0), N-Media Post Front-end Form (versions \u003c 1.1) plugins for WordPress are vulnerable to arbitrary file uploads due to missing file type validation via the `nm_filemanager_upload_file` and `nm_postfront_upload_file` AJAX actions. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-07","score":0.06684,"percentile":0.93943,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-434"],"published":"2024-10-16T07:31:49Z","modified":"2026-06-17T00:41:03Z","exploits":[{"source":"nuclei","id":"CVE-2016-15042","title":"WordPress Frontend File Manager \u003c 4.0 \u0026 N-Media Post Frontend \u003c 1.1 - Arbitrary File Upload","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-15042.yaml"},{"source":"pocgithub","id":"ImBIOS/lab-cve-2016-15042","title":"ImBIOS/lab-cve-2016-15042","date":"2025-09-03","url":"https://github.com/ImBIOS/lab-cve-2016-15042"}],"products":[{"vendor":"najeebmedia","product":"frontend_file_manager"},{"vendor":"najeebmedia","product":"n-media_post_front-end_form"},{"vendor":"najeebmedia","product":"post_front-end_form"},{"vendor":"nmedia","product":"frontend file manager plugin"},{"vendor":"nmedia","product":"n-media post front-end form"},{"vendor":"unknown","product":"frontend file manager plugin"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c1e6298-f243-49a5-b1b7-52bd6a6c8858?source=cve","tags":["Third Party Advisory"]},{"url":"https://www.pluginvulnerabilities.com/2016/09/19/arbitrary-file-upload-vulnerability-in-front-end-file-upload-and-manager-plugin/","tags":["Exploit","Third Party Advisory"]},{"url":"https://wordpress.org/plugins/nmedia-user-file-uploader/#developers","tags":["Product"]},{"url":"https://wpscan.com/vulnerability/052f7d9a-aaff-4fb1-92b7-aeb83cc705a7","tags":["Third Party Advisory"]},{"url":"https://www.pluginvulnerabilities.com/2016/09/19/arbitrary-file-upload-vulnerability-in-n-media-post-front-end-form/","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-n-media-post-front-end-form-arbitrary-file-upload-1-0/","tags":["Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-15042"},{"url":"https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-n-media-post-front-end-form-arbitrary-file-upload-1-0"},{"url":"https://www.pluginvulnerabilities.com/2016/09/19/arbitrary-file-upload-vulnerability-in-front-end-file-upload-and-manager-plugin"},{"url":"https://www.pluginvulnerabilities.com/2016/09/19/arbitrary-file-upload-vulnerability-in-n-media-post-front-end-form"},{"url":"https://github.com/advisories/GHSA-98v8-mh4j-wqg7"}],"sources":{"cve":[{"id":"CVE-2016-15042","title":"Frontend File Manager \u003c 4.0 \u0026 N-Media Post Front-end Form \u003c 1.1 \u0026 - Arbitrary File Upload","description":"The Frontend File Manager (versions \u003c 4.0), N-Media Post Front-end Form (versions \u003c 1.1) plugins for WordPress are vulnerable to arbitrary file uploads due to missing file type validation via the `nm_filemanager_upload_file` and `nm_postfront_upload_file` AJAX actions. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.","status":"published","published":"2024-10-16T07:31:49.718Z","modified":"2026-04-08T16:43:49.032Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:33:32.415289Z"}],"euvd":[{"id":"EUVD-2016-10786","description":"The Frontend File Manager (versions \u003c 4.0), N-Media Post Front-end Form (versions \u003c 1.1) plugins for WordPress are vulnerable to arbitrary file uploads due to missing file type validation via the `nm_filemanager_upload_file` and `nm_postfront_upload_file` AJAX actions. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.","status":"published","published":"2024-10-16T07:31:49Z","modified":"2026-04-08T16:43:49Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:25:04.728681Z"}],"ghsa":[{"id":"GHSA-98v8-mh4j-wqg7","title":"The Frontend File Manager (versions \u003c 4.0), N-Media Post Front-end Form (versions \u003c 1.1) plugins...","description":"The Frontend File Manager (versions \u003c 4.0), N-Media Post Front-end Form (versions \u003c 1.1) plugins for WordPress are vulnerable to arbitrary file uploads due to missing file type validation via the `nm_filemanager_upload_file` and `nm_postfront_upload_file` AJAX actions. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.","status":"published","published":"2024-10-16T09:30:31Z","modified":"2024-10-16T09:30:38Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:58:30.925935Z"}],"nvd":[{"id":"CVE-2016-15042","description":"The Frontend File Manager (versions \u003c 4.0), N-Media Post Front-end Form (versions \u003c 1.1) plugins for WordPress are vulnerable to arbitrary file uploads due to missing file type validation via the `nm_filemanager_upload_file` and `nm_postfront_upload_file` AJAX actions. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.","status":"published","published":"2024-10-16T08:15:02.99Z","modified":"2026-06-17T00:41:03.7Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:03:40.811555Z"}]}}