Frontend File Manager Plugin EUVD-2026-51947

Two distinct exploitation paths exist. Standard path: the victim must be logged in to the WordPress site and must be tricked into visiting an attacker-controlled page or loading attacker-controlled content (UI:R per CVSS) - the attacker requires no authentication themselves (PR:N per CVSS). Elevated-risk path: the WordPress site must have the guest uploads feature explicitly enabled in the Frontend File Manager Plugin settings; when this non-default configuration is active, the metadata update action is reachable with no authentication and no user interaction required, allowing direct unauthenticated HTTP POST requests against any user's uploaded file. Limiting factors on the standard path are the requirement for simultaneous victim login and social engineering (UI:R). The guest-upload path's only limiting factor is the non-default plugin configuration, which site owners can immediately disable as a compensating control.

The NVD-assigned CVSS 3.1 score of 5.4 Medium (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) reflects a standard CSRF impact envelope: network-reachable, low complexity, but requiring victim interaction (UI:R), keeping real-world severity moderate. However, the guest-upload configuration path effectively negates UI:R entirely - when that feature is enabled, no victim interaction is required, and the realistic severity escalates meaningfully toward the AV:N/AC:L/PR:N/UI:N ceiling. EPSS at 0.10% (1st percentile) suggests this has not been broadly exploited despite a published POC from WPScan. The vulnerability is not in CISA KEV. The core risk is confidentiality (file exfiltration via metadata manipulation) and integrity (tampered file metadata). Priority should be elevated specifically for WordPress deployments with guest uploads enabled, where the no-interaction unauthenticated path represents a substantially higher real-world risk than the base CVSS score implies.

An attacker crafts a malicious HTML page containing a hidden form or JavaScript that silently submits a POST request to the WordPress site's file-metadata update endpoint for a known file belonging to a logged-in user; when the victim visits the page while authenticated, their browser automatically sends the forged request, which the plugin processes without nonce validation, updating the file metadata. The attacker then leverages the manipulated metadata to trigger an unauthorized download of the victim's file. A publicly available exploit exists per WPScan; on sites with guest uploads enabled, this scenario requires no victim interaction - the attacker sends the request directly without needing the victim's session.