Unauthorized File Sharing Vulnerability in Frontend File Manager Plugin for WordPress
CVE-2026-1280

7.5HIGH

Key Information:

Vendor

WordPress
Status
Frontend File Manager Plugin
Vendor
CVE Published:
28 January 2026

What is CVE-2026-1280?

The Frontend File Manager Plugin for WordPress exhibits a security weakness that allows unauthorized users to share files through email without adequate checks. Specifically, the 'wpfm_send_file_in_email' AJAX action lacks proper capability verification in all versions up to and including 23.5. This oversight enables unauthenticated attackers to exploit sequential file IDs to enumerate and retrieve sensitive files meant for administrative access, potentially leading to data breaches.

Affected Version(s)

Frontend File Manager Plugin 0 <= 23.5

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/nmedia-user-fi...
https://plugins.trac.wordpress.org/browser/nmedia-user-fi...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Md. Moniruzzaman Prodhan
.