EUVD-2026-42011
GHSA-wvw5-gh7q-m6w3
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
Remote unauthenticated (AV:N/PR:N/UI:N); AC:H because guest upload mode must be enabled; S:C with I:H/A:H as deleting host config affects the whole site; C:N since the flaw deletes rather than reads files.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
4DescriptionCVE.org
The Frontend File Manager Plugin WordPress plugin through 23.6 does not validate a file path derived from user input before deleting the referenced file, allowing unauthenticated users to delete arbitrary files on the server (such as wp-config.php) when guest upload mode is enabled. Deleting wp-config.php forces the site into its setup routine, which can be leveraged toward a full site takeover.
AnalysisAI
Arbitrary file deletion in the WordPress Frontend File Manager Plugin (versions up to and including 23.6) lets unauthenticated visitors remove any file on the server when guest upload mode is enabled, because a user-supplied file path is not validated before the delete operation. Removing critical files such as wp-config.php drops the site into its installation/setup routine, which an attacker can chain toward a complete site takeover. No public exploit is identified at time of analysis and EPSS is low (0.15%, 4th percentile), but the unauthenticated network vector and scope-changing impact make this a serious risk for exposed sites running the vulnerable configuration.
Technical ContextAI
The affected component is a third-party WordPress plugin (PHP) that provides a front-end file management interface, including a guest/anonymous upload and file-handling mode. The root cause is a missing path-validation / path-traversal weakness (CWE-22-class: improper limitation of a pathname to a restricted directory) - the plugin derives the target file path directly from client-supplied input and passes it to a delete routine without canonicalizing or restricting it to the intended upload directory. Because WordPress bootstraps configuration and DB credentials from wp-config.php, deleting that file causes core WordPress to treat the installation as uninitialized and serve the setup wizard, converting a file-deletion primitive into an installation-hijack primitive. Per the ENISA EUVD record (EUVD-2026-42011) the affected package is the Frontend File Manager Plugin for WordPress at all versions '0 ≤ 23.6'.
RemediationAI
No vendor-released patch version is identified in the available data, so upgrade to a fixed release (any version published above 23.6 by the plugin author) as soon as one is confirmed via the WPScan advisory (https://wpscan.com/vulnerability/30f208f6-9d7b-4aaf-8689-496521d1a1dc/) - do not assume a version number that is not stated. As an immediate compensating control, disable guest/anonymous upload mode in the plugin settings, which removes the unauthenticated attack surface entirely (trade-off: legitimate anonymous uploads stop working). If the plugin's front-end file operations are not needed, deactivate and remove the plugin. Additionally, restrict access to the plugin's front-end file-management/delete endpoints via web-server rules or a WAF, enforce least-privilege filesystem permissions so the web-server user cannot delete files outside the intended upload directory, and back up wp-config.php and the site so the installation can be restored if the setup routine is triggered. Monitor for unexpected reappearance of the WordPress setup wizard, which would indicate wp-config.php deletion.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today