CVE-2025-13382

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13382", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-18T20:35:25.380Z", "datePublished": "2025-11-25T07:28:24.012Z", "dateUpdated": "2026-04-08T17:14:25.152Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:14:25.152Z"}, "affected": [{"vendor": "nmedia", "product": "Frontend File Manager Plugin", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "23.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Frontend File Manager Plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 23.4. This is due to the plugin not validating file ownership before processing file rename requests in the '/wpfm/v1/file-rename' REST API endpoint. This makes it possible for authenticated attackers, with Subscriber-level access and above, to rename files uploaded by other users via the 'fileid' parameter."}], "title": "Frontend File Manager Plugin <= 23.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary File Renaming", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/aa8d5feb-2ae9-44b8-90b5-9fc67226855a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/nmedia-user-file-uploader/tags/23.4/inc/classes/class.rest.php#L20"}, {"url": "https://plugins.trac.wordpress.org/browser/nmedia-user-file-uploader/tags/23.4/inc/classes/class.rest.php#L52"}, {"url": "https://plugins.trac.wordpress.org/browser/nmedia-user-file-uploader/tags/23.5/inc/classes/class.rest.php#L20"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "cweId": "CWE-639", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Rajesh Singh"}], "timeline": [{"time": "2025-11-24T19:15:11.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-25T14:53:13.645655Z", "id": "CVE-2025-13382", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-25T14:53:21.862Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13382", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-25T14:53:13.645655Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-25T14:53:19.087Z"}}], "cna": {"title": "Frontend File Manager Plugin <= 23.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary File Renaming", "credits": [{"lang": "en", "type": "finder", "value": "Rajesh Singh"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "nmedia", "product": "Frontend File Manager Plugin", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "23.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-24T19:15:11.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/aa8d5feb-2ae9-44b8-90b5-9fc67226855a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/nmedia-user-file-uploader/tags/23.4/inc/classes/class.rest.php#L20"}, {"url": "https://plugins.trac.wordpress.org/browser/nmedia-user-file-uploader/tags/23.4/inc/classes/class.rest.php#L52"}], "descriptions": [{"lang": "en", "value": "The Frontend File Manager Plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 23.4. This is due to the plugin not validating file ownership before processing file rename requests in the '/wpfm/v1/file-rename' REST API endpoint. This makes it possible for authenticated attackers, with Subscriber-level access and above, to rename files uploaded by other users via the 'fileid' parameter."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-11-25T07:28:24.012Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13382", "state": "PUBLISHED", "dateUpdated": "2025-11-25T14:53:21.862Z", "dateReserved": "2025-11-18T20:35:25.380Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-25T07:28:24.012Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Frontend File Manager Plugin", "vendor": "nmedia", "versions": [{"lessThanOrEqual": "23.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Frontend File Manager Plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 23.4. This is due to the plugin not validating file ownership before processing file rename requests in the '/wpfm/v1/file-rename' REST API endpoint. This makes it possible for authenticated attackers, with Subscriber-level access and above, to rename files uploaded by other users via the 'fileid' parameter."}, {"lang": "es", "value": "El plugin Frontend File Manager para WordPress es vulnerable a Referencia Directa Insegura a Objeto en todas las versiones hasta la 23.4, inclusive. Esto se debe a que el plugin no valida la propiedad de los archivos antes de procesar las solicitudes de cambio de nombre de archivo en el endpoint de la API REST '/wpfm/v1/file-rename'. Esto hace posible que atacantes autenticados, con acceso de nivel Suscriptor y superior, cambien el nombre de archivos subidos por otros usuarios a trav\u00e9s del par\u00e1metro 'fileid'."}], "id": "CVE-2025-13382", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13382", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-25T14:53:13.645655Z", "version": "2.0.3"}}]}, "published": "2025-11-25T08:15:50.253", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/nmedia-user-file-uploader/tags/23.4/inc/classes/class.rest.php#L20"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/nmedia-user-file-uploader/tags/23.4/inc/classes/class.rest.php#L52"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/nmedia-user-file-uploader/tags/23.5/inc/classes/class.rest.php#L20"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/aa8d5feb-2ae9-44b8-90b5-9fc67226855a?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T17:57:59.821386+00:00", "value": {"mitigation_remediation": ["Upgrade the Frontend File Manager Plugin to version 23.5 or later, where the file\u2011rename API now enforces ownership checks.", "Restrict Subscriber roles from using the file\u2011rename REST endpoint by disabling the endpoint with a web\u2011application firewall or security plugin.", "Limit the ability of lower\u2011privileged users to upload or rename files by adjusting WordPress role capabilities or disabling file uploads for Subscriber users."], "summary": {"action": "Upgrade plugin", "impact": "Insecure Direct Object Reference allowing arbitrary file renaming by authenticated users"}, "threat_synthesis": {"affected_systems": "Affected systems are WordPress installations that have the nmedia Frontend File Manager Plugin installed in any version up through 23.4 inclusive. The vulnerable versions include all releases prior to 23.5, where the intended fix was applied. Administrators should verify whether their site runs any of these earlier versions.\n", "description_and_impact": "The Frontend File Manager Plugin for WordPress contains an insecure direct object reference in the REST API endpoint '/wpfm/v1/file-rename'. This flaw permits authenticated users with Subscriber level or higher access to rename any file belonging to another user by specifying its identifier. The result is a form of privilege abuse that can be used to manipulate file names, potentially obfuscate malicious files, overwrite or hide important data, or facilitate further exploitation if file names are part of configuration or referencing mechanisms. The weakness is classified as CWE-639, reflecting improper access control over resources. The overall security impact is moderate; the vulnerability does not lead directly to code execution but can undermine the integrity of user data and complicate system administration.\n", "risk_and_exploitability": "The CVSS score for this vulnerability is 4.3, indicating moderate risk. The EPSS score is less than 1%, suggesting a very low exploitation probability at present. The issue is not listed in the CISA KEV catalog. Exploitation requires that the attacker be authenticated under a role of Subscriber or higher, which is typically a regular WordPress user. The attacker can trigger the rename by sending a request to the API endpoint and providing a valid file identifier that does not belong to them. Because the plugin does not validate ownership before processing the rename, the action succeeds and the targeted file is renamed. Despite the mild severity, the presence of this flaw can create a foothold for more serious attacks or disrupt normal operations if file names are relied upon by other components. The attacker\u2019s capability is limited to renaming, with no direct privilege escalation, but the potential for deception or confusion makes it a notable security concern.\n"}}}}, "created": "2025-11-26T11:10:49.829141+00:00", "updated": "2026-04-21T18:00:11.747577+00:00", "vendors": ["najeebmedia", "najeebmedia$PRODUCT$frontend_file_manager_plugin", "wordpress", "wordpress$PRODUCT$wordpress"]}