Skip to content
fr Sign in
5.4 Medium

CVE-2026-16292 The Frontend File Manager Plugin WordPress plugin through 23.6 does not perform nonce validation on one of its…

Description

The Frontend File Manager Plugin WordPress plugin through 23.6 does not perform nonce validation on one of its file-metadata update actions, allowing an attacker to modify the metadata of a logged-in user's uploaded file via a CSRF attack, which can be leveraged to download that file. When guest uploads are enabled, the same action is reachable unauthenticated against any user's file.

Affected products and versions

Product Affected versions Fixed in
Frontend File Manager Plugin 23.6 earliest → 23.6 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Frontend File Manager Plugin

The 12 CVEs of Frontend File Manager Plugin →
CVE-2026-12277 The Frontend File Manager Plugin WordPress plugin through 23.6 does not validate a file path derived from user input… 8.7 High CVE-2026-8380 The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly verify ownership of every targeted post… 6.5 Medium CVE-2026-8378 The Frontend File Manager Plugin WordPress plugin through 23.6 does not sanitise nor escape a filename submitted to… 5.4 Medium CVE-2026-8379 The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly enforce its nonce check on the file… 7.5 High
Track this CVE