{"id":"CVE-2022-2356","title":"The Frontend File Manager & Sharing WordPress plugin before 1.1.3 does not filter file extensions when letting users upload files on the server, which may lead to malicious code being uploaded.","summary":"The Frontend File Manager & Sharing WordPress plugin before 1.1.3 does not filter file extensions when letting users upload files on the server, which may lead to malicious code being uploaded.","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-434"],"vendor":"mediajedi","product":"user_private_files","affected":["user_private_files < 1.1.3"],"patched":["user_private_files 1.1.3"],"published":"2022-08-08","updated":"2026-06-23","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2022-2356","references":[{"url":"https://wpscan.com/vulnerability/67f3948e-27d4-47a8-8572-616143b9cf43","label":"contact@wpscan.com"},{"url":"https://wpscan.com/vulnerability/67f3948e-27d4-47a8-8572-616143b9cf43","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://wpscan.com/vulnerability/67f3948e-27d4-47a8-8572-616143b9cf43/","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd"],"epss":0.00983,"epssPercentile":0.60842,"ingestedAt":"2026-06-29T13:24:33.495Z","slug":"CVE-2022-2356","body":"## Overview\n\nThe Frontend File Manager & Sharing WordPress plugin before 1.1.3 does not filter file extensions when letting users upload files on the server, which may lead to malicious code being uploaded.\n\n## Affected\n\n- `user_private_files < 1.1.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `user_private_files 1.1.3`","depth":"twilight","depthScore":49,"depthScoreParts":{"impact":48.4,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}