VulnSocial

CVE-2016-15042Disclosure(najeebmedia / frontend_file_manager)

LOWCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

The Frontend File Manager (versions < 4.0), N-Media Post Front-end Form (versions < 1.1) plugins for WordPress are vulnerable to arbitrary file uploads due to missing file type validation via the `nm_filemanager_upload_file` and `nm_postfront_upload_file` AJAX actions. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

najeebmedia CVEsBack to dashboard
1.5/ 10 priority

Sources & remediation

Exploit / PoC references
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-434

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • frontend_file_manager
  • post_front-end_form

Threat summary

  • Public PoC is present in monitored signal
  • 1 mentions across 1 observed day

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
najeebmedia
Products
frontend_file_managerpost_front-end_form

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-02-19: 1PoC Mentioned / Linked · 2026-02-19: 1Technical Details · 2026-02-19: 102-19
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • 0day Signal@0dayPublishing
    Disclosure

    🚨 CVE-2016-15042: Frontend File Manager &lt; 4.0 &amp; N-... Unauthenticated arbitrary file upload in two WP plugins via AJAX endpoints offers trivial RCE path; missing file type v... https://zerodaysignal.com/vulnerability/CVE-2016-15042 #netsec #vulnerability #CVE #sysadmin #zeroday

    Post summary

    The tweet announces a CVE-2016-15042 flaw that allows unauthenticated arbitrary file uploads in two WordPress plugins, enabling trivial remote code execution, and provides a link to further details.

    0000054
    131 followersView on X
CPE platform detail2 entries

2 of 2 entries

PartVendorProductVersionTarget SWTarget HW
Appnajeebmediafrontend_file_manager-wordpress-
Appnajeebmediapost_front-end_form-wordpress-

Explore more

Back to dashboardnajeebmedia CVEsfrontend_file_manager vulnerabilities