CVE-2026-8380
Frontend File Manager Plugin <= 23.6 - Author+ Arbitrary Post Deletion
CVSS Score
6.5
EPSS Score
0.2%
EPSS Percentile
8th
The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly verify ownership of every targeted post before permanent deletion, allowing authenticated users with author-level access and above to permanently delete arbitrary posts and pages. When the Frontend File Manager Plugin WordPress plugin through 23.6's "Allow guest uploads" setting is enabled by an administrator, the same deletion primitive becomes reachable by unauthenticated users.
| Vendor | unknown |
| Product | frontend file manager plugin |
| Published | Jun 26, 2026 |
| Last Updated | Jun 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown frontend file manager plugin
Be the first to know when new medium vulnerabilities affecting unknown frontend file manager plugin are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Frontend File Manager Plugin
0 ≤ 23.6
References
Credits
Tiago Ferreira WPScan