Cross-Site Request Forgery Vulnerability in Frontend File Manager Plugin for WordPress
CVE-2026-16292
Currently unrated
What is CVE-2026-16292?
The Frontend File Manager Plugin for WordPress contains a vulnerability that allows attackers to exploit missing nonce validation in a specific file-metadata update action. This vulnerability can enable an unauthorized user to manipulate the metadata of files uploaded by logged-in users, potentially allowing them to download these files. Additionally, if guest uploads are enabled, the affected action can be executed without authentication, posing a significant security risk to all users' uploaded files.
Affected Version(s)
Frontend File Manager Plugin 0 <= 23.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.