CVE-2026-8380 - Frontend File Manager Plugin <= 23.6 - Author+ Arbitrary Post Deletion

Back Back to CVE browser

MEDIUM

Frontend File Manager Plugin <= 23.6 - Author+ Arbitrary Post Deletion

Published Jun 26, 2026

6.5

MEDIUM

CVSS 3.1

EPSS 0.47%

Description

The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly verify ownership of every targeted post before permanent deletion, allowing authenticated users with author-level access and above to permanently delete arbitrary posts and pages. When the Frontend File Manager Plugin WordPress plugin through 23.6's "Allow guest uploads" setting is enabled by an administrator, the same deletion primitive becomes reachable by unauthenticated users.

Affected products

Vendor n/a Product Frontend File Manager Plugin Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=23.6

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Frontend File Manager Plugin

n/a

Version	Status	Constraints
0	affected	<=23.6

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (1)

https://wpscan.com/vulnerability/45fcbf74-45be-4cff-a81a-0fea903592a5/
exploitvdb-entrytechnical-description

Link	Providers	Tags
https://wpscan.com/vulnerability/45fcbf74-45be-4cff-a81a-0fea903592a5/		exploitvdb-entrytechnical-description

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Jun 26, 2026

Updated Jun 26, 2026

Reserved May 12, 2026

Link CVE-2026-8380

CISA Vulnrichment

Updated Jun 26, 2026

NVD

Status Deferred

Modified Jun 26, 2026

Link CVE-2026-8380

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-8380