EUVD-2026-39626
GHSA-rxrc-7q8v-cgpx
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Author-level WordPress access is low privilege (PR:L not PR:H); permanent arbitrary deletion yields high integrity and availability impact with no confidentiality component.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly verify ownership of every targeted post before permanent deletion, allowing authenticated users with author-level access and above to permanently delete arbitrary posts and pages. When the Frontend File Manager Plugin WordPress plugin through 23.6's "Allow guest uploads" setting is enabled by an administrator, the same deletion primitive becomes reachable by unauthenticated users.
AnalysisAI
Permanent deletion of arbitrary WordPress posts and pages is possible via the Frontend File Manager Plugin (all versions through 23.6), which omits ownership verification before executing delete operations. Any authenticated user holding author-level access or higher can permanently destroy content they do not own; when an administrator enables the 'Allow guest uploads' setting, the same endpoint becomes reachable by completely unauthenticated users. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Primary condition: the attacker must hold a WordPress account with at least author-level access (WordPress built-in role hierarchy: author < editor < administrator). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H contains a notable inconsistency: PR:H denotes high privileges (typically administrator), yet the description explicitly states exploitation requires only 'author-level access and above' - a low-privilege WordPress role (PR:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a low-trust WordPress author account - obtainable on sites with open user registration - enumerates post IDs (often sequential or discoverable via the REST API) and submits crafted deletion requests to the Frontend File Manager Plugin's endpoint, permanently destroying posts they do not own such as administrator drafts, published articles, or WooCommerce product listings. If the site administrator has enabled 'Allow guest uploads', the attacker requires no credentials at all and can mass-delete content from the public internet. … |
| Remediation | Patch status: no specific patched version has been confirmed from the available data - affected versions are listed as all releases through 23.6, and no fix release is identified in the WPScan advisory or NVD CPE data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Frontend File Manager Plugin
View allThe Frontend File Manager plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to, and inc
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Download in versions up t
Unauthenticated file disclosure in the Frontend File Manager Plugin for WordPress (all versions through 23.6) exposes ev
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated HTML Injection in versions up to, and in
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary Post Deletion in versions up t
The Frontend File Manager Plugin WordPress plugin before 22.6 has a vulnerability that allows an Editor+ user to bypass
The Frontend File Manager plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Post Meta Change in versions up to, and
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Content Injection in versions up to, and
Stored Cross-Site Scripting in the Frontend File Manager Plugin for WordPress (versions through 23.6) allows any authent
The Frontend File Manager Plugin WordPress plugin before 21.4 does not have CSRF check when uploading files, which could
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today