What is the CVSS score of EUVD-2026-39968?

EUVD-2026-39968 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Frontend File Manager are affected by EUVD-2026-39968?

The nmedia-user-file-uploader plugin for WordPress (versions through 23.6) contains an authenticated arbitrary file deletion vulnerability (CVE-2026-8095, CVSS 8.1) that allows Subscriber-level user…

How to fix or mitigate EUVD-2026-39968?

24 hours: Immediately disable the nmedia-user-file-uploader plugin across all WordPress instances; verify wp-config.php and other critical files remain intact; audit file access logs for unauthorized deletions from Subscriber-level accounts. 7 days: Conduct privilege audit of all Subscriber-level users, rotate credentials for suspicious accounts, and implement file system-level read-only protections on wp-config.php and other critical configuration files. 30 days: Monitor nmedia and Wordfence security advisories continuously for patch release; if unavailable, evaluate and deploy alternative file management solutions.

Frontend File Manager EUVD-2026-39968

| CVE-2026-8095 HIGH

External Control of File Name or Path (CWE-73)

2026-06-28 security@wordfence.com

GHSA-hhrc-vf2p-x5h3

PHP WordPress Information Disclosure

8.1

CVSS 3.1 · Vendor: wordfence

Severity by source

Vendor (wordfence) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

8.1 HIGH

Network AJAX endpoint (AV:N), simple case-bypass (AC:L), requires a Subscriber account (PR:L), no user interaction; arbitrary deletion gives high integrity/availability impact but no confidentiality (C:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (wordfence).

CVSS VectorVendor: wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 28, 2026 - 00:26 vuln.today

CVE Published

Jun 28, 2026 - 00:16 nvd

HIGH 8.1

DescriptionCVE.org

The Frontend File Manager Plugin plugin for WordPress is vulnerable to Authenticated Arbitrary File Deletion in versions up to and including 23.6. This is due to a case-sensitive bypass of the wpfm_dir_path parameter sanitization in the wpfm_file_meta_update AJAX handler, where supplying WPFM_DIR_PATH in uppercase evades the unset check and is normalized to wpfm_dir_path by sanitize_key() during update_post_meta(), allowing an attacker to overwrite the stored file path with an arbitrary filesystem path that is then passed directly to unlink() in delete_file_locally() without any directory containment validation. This makes it possible for authenticated attackers with Subscriber-level access to delete arbitrary files on the server, including sensitive files such as wp-config.php, potentially leading to full site takeover.

AnalysisAI

Authenticated arbitrary file deletion in the Frontend File Manager Plugin (nmedia-user-file-uploader) for WordPress versions through 23.6 lets Subscriber-level users delete any file on the server, including wp-config.php, which can cascade into full site takeover. The flaw stems from a case-sensitivity gap in input sanitization within the wpfm_file_meta_update AJAX handler that allows attacker-controlled paths to reach unlink() unchecked. Reported by Wordfence with a CVSS of 8.1; no public exploit identified at time of analysis and the issue is not on CISA KEV.

Technical ContextAI

The affected component is the nmedia-user-file-uploader WordPress plugin, a frontend upload/file-management tool that stores file paths as post meta. The root cause is CWE-73 (External Control of File Name or Path): the wpfm_file_meta_update handler performs an unset/sanitization check against the lowercase key 'wpfm_dir_path', but PHP array keys are case-sensitive, so supplying 'WPFM_DIR_PATH' in uppercase bypasses the unset guard. WordPress's sanitize_key() then lowercases the key during update_post_meta(), causing the attacker-supplied value to be written into the canonical 'wpfm_dir_path' meta. That stored path is later passed directly to unlink() inside delete_file_locally() (see files.php#L767 and file.class.php#L729) with no directory-containment or path-traversal validation, so any absolute or relative filesystem path can be targeted.

RemediationAI

Update the Frontend File Manager Plugin to the first release after 23.6 that addresses this issue (the input does not include an exact fixed version, so confirm the patched version via the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/506006ce-7b1c-4f9d-93f3-abc87abea2bb and the plugin changelog before deploying) - no vendor-released patch version is independently confirmed from the provided data. As compensating controls until patched: disable open user self-registration (Settings > General > 'Anyone can register') to remove the Subscriber-level prerequisite, with the trade-off that legitimate self-service signup stops working; deactivate the plugin entirely if the frontend file manager is non-essential, which removes the vulnerable AJAX handler at the cost of the upload feature; and restrict access to /wp-admin/admin-ajax.php for the wpfm_file_meta_update action via a WAF rule or web server config, accepting that overly broad rules may break legitimate plugin AJAX calls. Also ensure off-host backups and correct filesystem permissions so deletion of wp-config.php or other files can be recovered.