6.5
Medium
CVE-2026-8380 The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly verify ownership of every targeted post…
Description
The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly verify ownership of every targeted post before permanent deletion, allowing authenticated users with author-level access and above to permanently delete arbitrary posts and pages. When the Frontend File Manager Plugin WordPress plugin through 23.6's "Allow guest uploads" setting is enabled by an administrator, the same deletion primitive becomes reachable by unauthenticated users.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Frontend File Manager Plugin 23.6 | earliest → 23.6 | No fix stated |
References
- wpscan.com wpscan.com
Timeline
- Published
- Last modified
Other CVEs of Frontend File Manager Plugin
The 12 CVEs of Frontend File Manager Plugin →
CVE-2026-16292
The Frontend File Manager Plugin WordPress plugin through 23.6 does not perform nonce validation on one of its…
5.4
Medium
CVE-2026-12277
The Frontend File Manager Plugin WordPress plugin through 23.6 does not validate a file path derived from user input…
8.7
High
CVE-2026-8378
The Frontend File Manager Plugin WordPress plugin through 23.6 does not sanitise nor escape a filename submitted to…
5.4
Medium
CVE-2026-8379
The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly enforce its nonce check on the file…
7.5
High