CoreCVE
Back

HIGH

Frontend File Manager <= 21.5 - Missing Authorization to Unauthenticated Arbitrary Post Deletion

Published Jul 25, 2025

Description

The Frontend File Manager Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wpfm_delete_multiple_files() function in all versions up to, and including, 21.5. This makes it possible for unauthenticated attackers to delete arbitrary posts.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (3)

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED
Assigner Wordfence
Published Jul 25, 2025
Updated Apr 8, 2026
Reserved Jul 24, 2025
Link CVE-2023-7306

CISA Vulnrichment

Updated Jul 25, 2025

NVD

Status Deferred
Modified Jun 17, 2026
Link CVE-2023-7306

Red Hat

No data

ENISA EUVD

Assigner Wordfence
Published Jul 25, 2025
Updated Apr 8, 2026
Link EUVD-2023-59765

GitHub

No data