Frontend File Manager CVE-2026-8379

The Frontend File Manager Plugin must be installed and activated on the WordPress site - it is not a core WordPress component, so only sites that have explicitly installed it are vulnerable. Files must have been uploaded by users through the plugin's interface for there to be content to exfiltrate; a site with the plugin active but no uploads presents no sensitive data risk from this specific vector. The file download handler must be reachable over the network, which is the default for any public-facing WordPress site. No special configuration is required beyond plugin activation - the broken nonce check affects the default out-of-box handler. Limiting factors: exploitation is confined to files managed by this specific plugin (not all WordPress uploads); impact severity is proportional to the sensitivity of user-uploaded content on that particular site; no authentication bypass or code execution is involved - this is purely a confidentiality/disclosure issue.

The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) correctly reflects an unauthenticated, low-complexity, network-accessible confidentiality breach - the vector is internally consistent with the described behavior. However, EPSS sits at only 0.14% (3rd percentile) despite public POC availability, a notable divergence that suggests either low population of exploitable instances or limited threat-actor interest at the time of scoring; it should not be read as low risk by defenders whose sites run the plugin. SSVC flags the attack as automatable with poc-level exploitation and partial technical impact, which aligns with mass-scan tooling being able to harvest files from vulnerable sites without special access. The vulnerability is not in CISA KEV, meaning active in-the-wild exploitation has not been confirmed by CISA. The real-world risk is site-specific: any WordPress installation running Frontend File Manager Plugin ≤23.6 that holds sensitive user-uploaded content (contracts, ID documents, financial records) faces meaningful data-exposure risk from this publicly known, automatable technique. Sites with no sensitive uploads face minimal practical impact despite the high CVSS.

An attacker sends a series of unauthenticated HTTP GET or POST requests to the plugin's file download endpoint (e.g., wp-admin/admin-post.php or wp-ajax) incrementing a numeric file ID parameter from 1 upward, omitting or supplying an invalid nonce value. Because the nonce check is not properly enforced, the server returns each file's contents directly, allowing the attacker to bulk-download all user-uploaded files - such as scanned ID documents, contracts, or medical records - in minutes using a simple loop script. A public POC documented by WPScan confirms this technique is viable without authentication against default plugin installations through version 23.6.