CVE-2021-4368: 
WordPress vulnerability analysis and mitigation

The Frontend File Manager plugin for WordPress (versions up to 18.2) contains a critical vulnerability identified as CVE-2021-4368. The vulnerability was discovered and disclosed on July 12, 2021, and was last analyzed on June 7, 2023. The issue affects the plugin's settings management functionality and was identified by Jerome Bruandet of NinTechNet (Wordfence).

The vulnerability stems from missing capability checks and security nonce verification in the wpfm_save_settings AJAX action. This security flaw allows authenticated users with subscriber-level access to modify plugin settings, including the configuration of allowed upload file types. The vulnerability has received a CVSS v3.1 score of 9.9 (Critical), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (NVD).

The vulnerability can lead to remote code execution through other vulnerabilities by allowing attackers to modify critical plugin settings, particularly the allowed upload file types. This could potentially enable malicious file uploads and subsequent server compromise (NVD).

Users should immediately update the Frontend File Manager plugin to a version newer than 18.2. The vulnerability has been patched in subsequent releases (WordPress Plugin Repository).