title: Frontend File Manager < 21.3 - Subscriber+ Arbitrary File Upload
description: The Frontend File Manager Plugin WordPress plugin before 21.3 allows any authenticated users, such as subscriber, to rename a file to an arbitrary extension, like PHP, which could allow them to basically be able to upload arbitrary files on the server and achieve RCE
problem types: CWE-434 Unrestricted Upload of File with Dangerous Type
affected:
{
product: Frontend File Manager Plugin
vendor: Unknown
versions:
lessThan: 21.3, status: affected, version: 21.3, versionType: custom
}