8.7
Élevée
CVE-2026-12277 The Frontend File Manager Plugin WordPress plugin through 23.6 does not validate a file path derived from user input…
Description
The Frontend File Manager Plugin WordPress plugin through 23.6 does not validate a file path derived from user input before deleting the referenced file, allowing unauthenticated users to delete arbitrary files on the server (such as wp-config.php) when guest upload mode is enabled. Deleting wp-config.php forces the site into its setup routine, which can be leveraged toward a full site takeover.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Frontend File Manager Plugin 23.6 | premières → 23.6 | Pas de correctif indiqué |
Autres CVE de Frontend File Manager Plugin
Les 12 CVE de Frontend File Manager Plugin →
CVE-2026-16292
The Frontend File Manager Plugin WordPress plugin through 23.6 does not perform nonce validation on one of its…
5.4
Moyenne
CVE-2026-8380
The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly verify ownership of every targeted post…
6.5
Moyenne
CVE-2026-8378
The Frontend File Manager Plugin WordPress plugin through 23.6 does not sanitise nor escape a filename submitted to…
5.4
Moyenne
CVE-2026-8379
The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly enforce its nonce check on the file…
7.5
Élevée