Authenticated Arbitrary File Deletion in Frontend File Manager Plugin for WordPress

CVE-2026-8095

What is CVE-2026-8095?

The Frontend File Manager Plugin for WordPress suffers from a critical vulnerability that enables authenticated attackers to perform arbitrary file deletion. This flaw arises from a case-sensitive bypass in the wpfm_dir_path parameter sanitization, permitting attackers to manipulate file paths and potentially delete essential files on the server. Specifically, this vulnerability affects versions up to and including 23.6, enabling users with Subscriber-level access to target and delete sensitive files such as wp-config.php. This silent exploitation can lead to complete site compromise, allowing for unauthorized access and data loss.

References