A critical file path manipulation vulnerability in the Frontend File Manager Plugin enables unauthorized file operations, posing a high risk to system integrity.

The plugin suffers from improper control of file names or paths (CWE-73). This allows an attacker to interact with files outside of the intended directory, potentially leading to unauthorized file modification or deletion.

The CVSS score of 8.7 (High) reflects the severity of this vulnerability, as it allows for significant impact on system availability and integrity. Successful exploitation could lead to the deletion of critical system files or the overwriting of configuration files, causing catastrophic service disruption and potential loss of data integrity.

Immediate Action: Immediately update to the latest version of the plugin or disable it until a secure patch is confirmed and applied.

Proactive Monitoring: Monitor server logs for unusual file system access patterns and attempts to access files outside of the standard web application directories.

Compensating Controls: Deploy a Web Application Firewall (WAF) to detect and block path traversal patterns (e.g., ../) in HTTP requests.

Public Exploit Available: true

Given the existence of a public exploit, the urgency to remediate this vulnerability is extreme. Organizations should prioritize updating or removing this plugin to prevent exploitation, as the technical impact on file integrity is significant.