CVE-2016-15042

These are WordPress plugins that let website visitors upload files, like a drop-box for forms. A flaw means the plugin never checks what kind of file is being uploaded, so an attacker can disguise a malicious program as a file and have it run on your server — like handing a mailroom clerk a parcel that's actually a bomb, and the clerk never checks what's inside before letting it through.

This matters to you if your WordPress site uses the Frontend File Manager plugin or the N-Media Post Front-end Form plugin for letting users upload files through front-end forms. No login or user interaction is needed for an attacker to exploit this, so any site running a vulnerable version is at risk if the site is reachable on the internet.

Attackers are actively exploiting this flaw, with sustained press coverage confirming real-world attacks against sites running these plugins. This is not a theoretical risk — treat it as an active threat and update or disable the plugin today.

Confirm exposure by checking the installed plugin version in wp-admin > Plugins for 'Frontend File Manager' (target fixed version 4.0+) and 'Post Front-end Form' (target fixed version 1.1+). Both are simple drop-in version upgrades with no known breaking changes reported. If immediate patching isn't possible, deactivate the plugin or block the nm_filemanager_upload_file and nm_postfront_upload_file AJAX endpoints at the web server/WAF layer as a temporary workaround. Since this is not currently in CISA KEV, there is no federal remediation deadline, but ongoing exploitation reported in the press means it should be treated with KEV-level urgency. After patching, audit the wp-content/uploads directory and site file integrity for webshells or unexpected PHP files, and review admin user accounts and scheduled tasks for signs of prior compromise.

CVSS 9.8 (Critical) with network attack vector, no privileges or user interaction required, and full compromise of confidentiality, integrity and availability. Weakness is CWE-434 (Unrestricted Upload of File with Dangerous Type), reachable via unauthenticated AJAX actions missing file-type validation, enabling remote code execution. Not listed in CISA KEV, but sustained press attention attributes active exploitation. Exploit maturity is limited to a detection template rather than a published working exploit, though EPSS scores it in the 93rd percentile (predicted likelihood, trending downward) — exploitation reports from press coverage should be weighted above this predictive score.