EUVD-2026-51947
GHSA-2rf9-6fhx-g6mg
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Attacker needs no privileges; victim interaction required for standard CSRF path; limited confidentiality and integrity impact via file metadata manipulation only.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
The Frontend File Manager Plugin WordPress plugin through 23.6 does not perform nonce validation on one of its file-metadata update actions, allowing an attacker to modify the metadata of a logged-in user's uploaded file via a CSRF attack, which can be leveraged to download that file. When guest uploads are enabled, the same action is reachable unauthenticated against any user's file.
AnalysisAI
Cross-site request forgery in the Frontend File Manager Plugin for WordPress (all versions through 23.6) enables attackers to silently modify file metadata belonging to authenticated users by luring victims to attacker-controlled pages, with the corrupted metadata directly enabling unauthorized download of those files. When the plugin's guest upload feature is active, the vulnerable metadata update endpoint becomes fully unauthenticated, eliminating the need for any victim interaction and exposing every user's uploaded files to arbitrary metadata manipulation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two distinct exploitation paths exist. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 score of 5.4 Medium (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) reflects a standard CSRF impact envelope: network-reachable, low complexity, but requiring victim interaction (UI:R), keeping real-world severity moderate. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious HTML page containing a hidden form or JavaScript that silently submits a POST request to the WordPress site's file-metadata update endpoint for a known file belonging to a logged-in user; when the victim visits the page while authenticated, their browser automatically sends the forged request, which the plugin processes without nonce validation, updating the file metadata. The attacker then leverages the manipulated metadata to trigger an unauthorized download of the victim's file. … |
| Remediation | No vendor-released patched version has been identified at time of analysis - affected versions span all releases through 23.6 with no confirmed fixed release in the provided data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Frontend File Manager Plugin
View allThe Frontend File Manager plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to, and inc
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Download in versions up t
Unauthenticated file disclosure in the Frontend File Manager Plugin for WordPress (all versions through 23.6) exposes ev
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated HTML Injection in versions up to, and in
Permanent deletion of arbitrary WordPress posts and pages is possible via the Frontend File Manager Plugin (all versions
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary Post Deletion in versions up t
The Frontend File Manager Plugin WordPress plugin before 22.6 has a vulnerability that allows an Editor+ user to bypass
The Frontend File Manager plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Post Meta Change in versions up to, and
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Content Injection in versions up to, and
Stored Cross-Site Scripting in the Frontend File Manager Plugin for WordPress (versions through 23.6) allows any authent
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today