October 12, 2026

CyberWorldOps Cyber Security · Threat Intelligence · CVE

CVE-2016-15042

Critical9.8 Published on Oct 16, 2024

The Frontend File Manager (versions < 4.0), N-Media Post Front-end Form (versions < 1.1) plugins for WordPress are vulnerable to arbitrary file uploads due to missing file type validation via the `nm_filemanager_upload_file` and `nm_postfront_upload_file` AJAX actions. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

Early warning: exploitation observed

Exploitation observed since Oct 15, 2024
Not yet in the official CISA catalogue
Attacked 1 day before the vulnerability was made public

Source: VulnCheck KEV · Oct 15, 2024

CVSS score9.8 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness type (CWE)CWE-434

Vendorsnajeebmedia

Affected products

Vendors	Product	Versions
najeebmedia	frontend file manager	< 4.0
najeebmedia	post front-end form	< 1.1

Related articles

Bricksforge WordPress flaw CVE-2026-85097 is under attack, letting anonymous visitors run PHP

Vulnerabilities

Bricksforge WordPress flaw CVE-2026-85097 is under attack, letting anonymous visitors run PHP

Attackers exploit Bricksforge flaw to upload files as PHP without login, risking site takeover. Update advised and check uploads for abuse.

Oct 12, 202611:01 5 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.