LiveActive security incident?Get immediate response
CVE Record

CVE-2021-4359: Frontend File Manager Plugin <= 18.2 - Unauthenticated Arbitrary Post Deletion

The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary Post Deletion in versions up to, and including, 18.2. This is due to lacking authentication protections and lacking a security nonce on the wpfm_delete_file AJAX action. This makes it possible for unauthenticated attackers to delete any posts and pages on the site.

MediumCVSS 6.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This WordPress plugin flaw can let an unauthenticated visitor delete site posts or pages. It affects Frontend File Manager versions up to and including 18.2. The main business impact is content loss, site disruption, and potential recovery work, not data theft based on the provided CVSS and description.

Executive priority

Treat this as a prompt WordPress hygiene issue. It is not described as actively exploited or critical, but unauthenticated content deletion can cause public-site disruption and reputational impact.

Technical view

CVE-2021-4359 is a missing authorization issue in the Frontend File Manager plugin's wpfm_delete_file AJAX action. The source states the action lacks authentication protection and a security nonce, allowing unauthenticated arbitrary post or page deletion. CVSS 3.1 is 6.5: network exploitable, low complexity, no privileges, no user interaction.

Likely exposure

Exposure is limited to WordPress sites running the nmedia Frontend File Manager plugin at version 18.2 or earlier. The provided affected metadata is incomplete, so asset validation should rely on installed plugin names and versions.

Exploitation context

The source bundle does not show CISA KEV listing or cited evidence of active exploitation. The vulnerability is remotely reachable and unauthenticated, but the documented impact is deletion of posts and pages rather than code execution or data disclosure.

Researcher notes

Evidence supports CWE-862 missing authorization on an AJAX action, with integrity and availability impact. The affected-version metadata appears sparse, so use the narrative description and vendor references rather than relying only on CPE data.

Mitigation direction

  • Inventory WordPress sites for the Frontend File Manager plugin.
  • Update affected installations to a vendor-fixed release newer than 18.2.
  • Disable or remove the plugin if no fixed release is available.
  • Check vendor, WordPress plugin, and security vendor guidance before redeploying.
  • Ensure reliable WordPress content backups exist before remediation work.

Validation and detection

  • Confirm whether the plugin is installed on each WordPress site.
  • Record installed plugin versions and flag 18.2 or earlier.
  • Review web logs for suspicious unauthenticated AJAX deletion activity.
  • Check for unexpected missing, trashed, or deleted posts and pages.
  • Verify the plugin is updated, disabled, or removed after remediation.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-862: Authorization and privilege behavior lookup

Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-4359 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.5CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L3.92.5Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

6.5Medium
CVSS 3.1 vector shape for CVE-2021-4359Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
nmediaFrontend File Manager Plugin0unaffected
Weakness

CWE details

CWE-862

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-862 · source CWE mapping

Missing Authorization

Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs