EUVD-2026-39626
GHSA-rxrc-7q8v-cgpx
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Author-level WordPress access is low privilege (PR:L not PR:H); permanent arbitrary deletion yields high integrity and availability impact with no confidentiality component.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly verify ownership of every targeted post before permanent deletion, allowing authenticated users with author-level access and above to permanently delete arbitrary posts and pages. When the Frontend File Manager Plugin WordPress plugin through 23.6's "Allow guest uploads" setting is enabled by an administrator, the same deletion primitive becomes reachable by unauthenticated users.
AnalysisAI
Permanent deletion of arbitrary WordPress posts and pages is possible via the Frontend File Manager Plugin (all versions through 23.6), which omits ownership verification before executing delete operations. Any authenticated user holding author-level access or higher can permanently destroy content they do not own; when an administrator enables the 'Allow guest uploads' setting, the same endpoint becomes reachable by completely unauthenticated users. A public proof-of-concept exists via WPScan; no confirmed actively exploited status (KEV), and EPSS sits at just 0.18% (8th percentile), but the unauthenticated attack path under a non-default configuration is the highest-severity scenario.
Technical ContextAI
The Frontend File Manager Plugin provides WordPress sites with a frontend interface for file and media management by non-admin users. The vulnerability is an authorization bypass in the plugin's post-deletion handler: it accepts a target post ID supplied by the client but does not verify that the requesting user is the owner of that post before executing a permanent delete. This is consistent with CWE-639 (Authorization Bypass Through User-Controlled Key), where a user-controlled identifier grants access to resources belonging to other users. The CPE string cpe:2.3:a:unknown:frontend_file_manager_plugin:*:*:*:*:*:*:*:* covers all versions up to and including 23.6, with the vendor identifier listed as 'unknown' in the NVD dictionary, indicating the plugin author is not formally registered. The plugin's 'Allow guest uploads' feature, when enabled by an administrator, exposes the same deletion endpoint without requiring any session or credential, widening the attack surface to unauthenticated external actors.
RemediationAI
Patch status: no specific patched version has been confirmed from the available data - affected versions are listed as all releases through 23.6, and no fix release is identified in the WPScan advisory or NVD CPE data. Administrators should monitor the plugin's WordPress.org repository page for a security release and apply it immediately upon availability. As an immediate compensating control, disable the 'Allow guest uploads' setting in the plugin configuration; this closes the unauthenticated attack vector (note: this does not address the authenticated author-level path). Restrict author-level (and above) WordPress accounts to fully trusted individuals, and audit existing accounts for unnecessary elevated roles, as this reduces the authenticated attack surface. If the plugin's frontend file management functionality is non-critical, deactivating and fully removing the plugin eliminates all exposure with no functional side effects for core WordPress operation. References: WPScan advisory at https://wpscan.com/vulnerability/45fcbf74-45be-4cff-a81a-0fea903592a5/ and NVD at https://nvd.nist.gov/vuln/detail/CVE-2026-8380.
More in Frontend File Manager Plugin
View allThe Frontend File Manager plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to, and inc
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Download in versions up t
Unauthenticated file disclosure in the Frontend File Manager Plugin for WordPress (all versions through 23.6) exposes ev
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated HTML Injection in versions up to, and in
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary Post Deletion in versions up t
Frontend File Manager Plugin for WordPress through version 23.6 allows authenticated Subscriber-level users and higher t
The Frontend File Manager Plugin WordPress plugin before 22.6 has a vulnerability that allows an Editor+ user to bypass
The Frontend File Manager plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Post Meta Change in versions up to, and
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Content Injection in versions up to, and
Stored Cross-Site Scripting in the Frontend File Manager Plugin for WordPress (versions through 23.6) allows any authent
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today