Unauthorized File Deletion in Frontend File Manager Plugin by WordPress
CVE-2026-12277
Currently unrated
What is CVE-2026-12277?
The Frontend File Manager Plugin for WordPress, version 23.6, is susceptible to a vulnerability that allows unauthenticated users to delete arbitrary files on the server without proper validation of file paths derived from user input. This issue is particularly concerning when guest upload mode is enabled, as it permits the deletion of critical files, such as wp-config.php. Executing this action triggers the site's setup routine, potentially enabling attackers to take full control of the site.
Affected Version(s)
Frontend File Manager Plugin 0 <= 23.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.