CVE-2016-15042

The Frontend File Manager (versions < 4.0), N-Media Post Front-end Form (versions < 1.1) plugins for WordPress are vulnerable to arbitrary file uploads due to missing file type validation via the `nm_filemanager_upload_file` and `nm_postfront_upload_file` AJAX actions. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

• CWE-434

• https://wordpress.org/plugins/nmedia-user-file-uploader/#developersProduct
• https://wpscan.com/vulnerability/052f7d9a-aaff-4fb1-92b7-aeb83cc705a7Third Party Advisory
• https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-n-media-post-front-end-form-arbitrary-file-upload-1-0/Third Party Advisory
• https://www.pluginvulnerabilities.com/2016/09/19/arbitrary-file-upload-vulnerability-in-front-end-file-upload-and-manager-plugin/Exploit, Third Party Advisory
• https://www.pluginvulnerabilities.com/2016/09/19/arbitrary-file-upload-vulnerability-in-n-media-post-front-end-form/Exploit, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/2c1e6298-f243-49a5-b1b7-52bd6a6c8858?source=cveThird Party Advisory

Published

Oct 16, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-15037A vulnerability, which was classified as problematic, has be…6.1
• CVE-2016-15038A vulnerability, which was classified as critical, was found…6.5
• CVE-2016-15039A vulnerability classified as critical was found in mhuertos…6.3
• CVE-2016-1504dhcpcd before 6.10.0 allows remote attackers to cause a deni…
• CVE-2016-15040The Kento Post View Counter plugin for WordPress is vulnerab…9.8
• CVE-2016-15041The MainWP Dashboard – The Private WordPress Manager for Mul…6.1
• CVE-2016-15043The WP Mobile Detector plugin for WordPress is vulnerable to…9.8
• CVE-2016-15044A remote code execution vulnerability exists in Kaltura vers…9.3
• CVE-2016-15045A local privilege escalation vulnerability exists in lastore…8.5
• CVE-2016-15046A client-side remote code execution vulnerability exists in …8.6
• CVE-2016-15047AVTECH devices that include the CloudSetup.cgi management en…8.7
• CVE-2016-15048AMTT Hotel Broadband Operation System (HiBOS) contains an un…9.8