Unauthorized Deletion Vulnerability in Frontend File Manager Plugin for WordPress
CVE-2026-8380
What is CVE-2026-8380?
The Frontend File Manager Plugin for WordPress prior to version 23.6 contains a critical flaw in its post deletion functionality. It fails to correctly verify ownership of posts, enabling authenticated users with author-level access or higher to delete any posts or pages. This issue is exacerbated when the 'Allow guest uploads' option is activated by an administrator, granting unauthenticated users the ability to delete posts. This vulnerability poses a significant risk, as it compromises content integrity and can lead to data loss.
Affected Version(s)
Frontend File Manager Plugin 0 <= 23.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.