CVE-2016-15042

CriticalPublished

Frontend File Manager < 4.0 & N-Media Post Front-end Form < 1.1 & - Arbitrary File Upload

Published: Oct 16, 2024
Updated: Apr 8, 2026
Assigning CNA: Wordfence
Evidence observed: Aug 10, 2026

Primary CVSS

9.8/ 10Critical

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS probability estimate

5.7%

Low · next 30 days

Percentile: 92.9%
Model date: Oct 13, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

The Frontend File Manager (versions < 4.0), N-Media Post Front-end Form (versions < 1.1) plugins for WordPress are vulnerable to arbitrary file uploads due to missing file type validation via the `nm_filemanager_upload_file` and `nm_postfront_upload_file` AJAX actions. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

Sources

Repository evidence: Files: 1 · Repositories: 1

1 Template

WordPress Frontend File Manager < 4.0 & N-Media Post Frontend < 1.1 - Arbitrary File UploadTemplate
http/cves/2016/CVE-2016-15042.yaml
Nuclei Templates
DetectionEvidence observed: Sep 25, 2026Revision: d10390c11a88Related tool
Declared conditions
- network: http($.protocol_keys)
- verification: dsl($.matchers[*].type)

lab-cve-2016-15042PoC
CVE-2016-15042 lab: Dockerized WordPress PoC for unauthenticated file upload in Frontend File Manager <4.0 and N‑Media Post Front‑end Form <1.1

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.