CVE-2026-8380
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk8th percentile — higher than 8% of all known CVEs
Summary
The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly verify ownership of every targeted post before permanent deletion, allowing authenticated users with author-level access and above to permanently delete arbitrary posts and pages. When the 'Allow guest uploads' setting is enabled by an administrator, the same deletion primitive becomes reachable by unauthenticated users.
Risk Assessment
The organization is at risk of unauthorized permanent deletion of content, which can lead to data loss, website disruption, and potential financial and reputational damage.
Recommendation
Immediately update the Frontend File Manager plugin to the latest available version. If an update is not possible, disable the 'Allow guest uploads' setting and restrict user permissions to the minimum necessary.
Original NVD description (English source)
The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly verify ownership of every targeted post before permanent deletion, allowing authenticated users with author-level access and above to permanently delete arbitrary posts and pages. When the Frontend File Manager Plugin WordPress plugin through 23.6's "Allow guest uploads" setting is enabled by an administrator, the same deletion primitive becomes reachable by unauthenticated users.