EUVD-2026-38420
GHSA-9v4r-j6qw-wjw2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-accessible, no authentication, no user interaction required; impact limited to confidentiality via file disclosure with no integrity or availability consequence.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly enforce its nonce check on the file download handler, allowing unauthenticated attackers to download files uploaded by any user through the Frontend File Manager Plugin WordPress plugin through 23.6 by iterating identifiers.
Articles & Coverage 1
AnalysisAI
Unauthenticated file disclosure in the Frontend File Manager Plugin for WordPress (all versions through 23.6) exposes every user-uploaded file to anonymous download via identifier enumeration. The plugin's file download handler fails to properly enforce WordPress nonce validation, stripping the only access control gate between unauthenticated HTTP requests and user-uploaded content. A public proof-of-concept is available via WPScan, and SSVC assessment confirms the attack is automatable - any script that iterates numeric file identifiers can bulk-harvest uploaded documents, images, or sensitive attachments without credentials. Not currently listed in CISA KEV.
Technical ContextAI
WordPress nonces serve as short-lived CSRF tokens tied to a specific action, user, and time window; they are the primary mechanism WordPress uses to authorize form submissions and AJAX handler calls. The Frontend File Manager Plugin registers a file download handler - likely an AJAX action or admin-post endpoint - that is supposed to validate a nonce before serving the requested file. The flaw is that this check is improperly enforced: the validation is either skipped under certain request conditions, bypassable with a missing or empty nonce parameter, or the handler is accessible via a code path that never triggers the check. Combined with predictable or sequential file identifiers (an Insecure Direct Object Reference pattern, mapping to CWE-639 or CWE-345 even though CWE is listed as N/A in NVD), an attacker can iterate identifiers to enumerate and retrieve all files stored by the plugin. CPE data identifies the affected software as cpe:2.3:a:unknown:frontend_file_manager_plugin:*:*:*:*:*:*:*:* with versions 0 through 23.6 confirmed affected by EUVD-2026-38420.
RemediationAI
No specific patched version number is confirmed in the available data; the WPScan advisory at https://wpscan.com/vulnerability/71619406-19bb-437f-9538-fdf73de98827/ should be consulted for the current fix version as the WordPress plugin repository may have issued a patched release. Site administrators should update the Frontend File Manager Plugin to the latest available version immediately and verify the download handler enforces nonce validation post-update. As an immediate compensating control prior to patching, disable the plugin entirely via the WordPress admin dashboard (Plugins → Deactivate) - this removes the vulnerable download handler from the attack surface with no residual file-exposure risk, though it also removes file management functionality for users. If disabling is not operationally feasible, consider restricting access to the WordPress upload directory and any plugin-specific download endpoints at the web server or WAF layer by requiring authentication before serving requests to those paths. Note that web server-level restrictions may break legitimate authenticated user functionality and require testing before deployment in production.
More in Frontend File Manager Plugin
View allThe Frontend File Manager plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to, and inc
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Download in versions up t
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated HTML Injection in versions up to, and in
Permanent deletion of arbitrary WordPress posts and pages is possible via the Frontend File Manager Plugin (all versions
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary Post Deletion in versions up t
The Frontend File Manager Plugin WordPress plugin before 22.6 has a vulnerability that allows an Editor+ user to bypass
The Frontend File Manager plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Post Meta Change in versions up to, and
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Content Injection in versions up to, and
Stored Cross-Site Scripting in the Frontend File Manager Plugin for WordPress (versions through 23.6) allows any authent
Cross-site request forgery in the Frontend File Manager Plugin for WordPress (all versions through 23.6) enables attacke
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today