EUVD-2026-42011
GHSA-wvw5-gh7q-m6w3
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
Remote unauthenticated (AV:N/PR:N/UI:N); AC:H because guest upload mode must be enabled; S:C with I:H/A:H as deleting host config affects the whole site; C:N since the flaw deletes rather than reads files.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
The Frontend File Manager Plugin WordPress plugin through 23.6 does not validate a file path derived from user input before deleting the referenced file, allowing unauthenticated users to delete arbitrary files on the server (such as wp-config.php) when guest upload mode is enabled. Deleting wp-config.php forces the site into its setup routine, which can be leveraged toward a full site takeover.
AnalysisAI
Arbitrary file deletion in the WordPress Frontend File Manager Plugin (versions up to and including 23.6) lets unauthenticated visitors remove any file on the server when guest upload mode is enabled, because a user-supplied file path is not validated before the delete operation. Removing critical files such as wp-config.php drops the site into its installation/setup routine, which an attacker can chain toward a complete site takeover. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the plugin's guest upload mode to be enabled - this is the decisive prerequisite; without it, the unauthenticated delete path is not reachable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are mixed and should be weighed together. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker locates a WordPress site running the Frontend File Manager Plugin (≤23.6) with guest upload mode enabled and sends a crafted unauthenticated request to the plugin's file-delete function containing a traversal path pointing at wp-config.php. The plugin deletes the file without validation; the next visit to the site loads the WordPress installation wizard, letting the attacker point the site at an attacker-controlled database and seize administrative control. … |
| Remediation | No vendor-released patch version is identified in the available data, so upgrade to a fixed release (any version published above 23.6 by the plugin author) as soon as one is confirmed via the WPScan advisory (https://wpscan.com/vulnerability/30f208f6-9d7b-4aaf-8689-496521d1a1dc/) - do not assume a version number that is not stated. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Audit all WordPress instances to identify Frontend File Manager Plugin installations; immediately disable guest upload mode on any affected site. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today