Insecure Direct Object Reference Vulnerability in Frontend File Manager Plugin for WordPress
CVE-2026-5337

Currently unrated

Key Information:

Vendor

WordPress
Status
Frontend File Manager Plugin
Vendor
CVE Published:
3 May 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-5337?

Authenticated attackers with Subscriber-level access or higher can exploit an Insecure Direct Object Reference in the Frontend File Manager Plugin for WordPress. This vulnerability arises from inadequate user authorization validation for file download requests. By manipulating the 'file_id' parameter in the download endpoint, attackers can gain access to files belonging to other users, including sensitive information from privileged accounts. Proper validation measures are crucial to safeguard sensitive data and prevent unauthorized access.

Affected Version(s)

Frontend File Manager Plugin 0 <= 23.6

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-5337 - Proof of Concept

References

https://wpscan.com/vulnerability/3e28aa78-3227-474a-b1db-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mohamad Nour Almujarkesh
WPScan
.