CVE-2026-8380

Frontend File Manager Plugin <= 23.6 - Author+ Arbitrary Post Deletion

Medium · published June 26, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
39.9
In the wild
Unconfirmed
What it is

The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly verify ownership of every targeted post before permanent deletion, allowing authenticated users with author-level access and above to permanently delete arbitrary posts and pages. When the Frontend File Manager Plugin WordPress plugin through 23.6's "Allow guest uploads" setting is enabled by an administrator, the same deletion primitive becomes reachable by unauthenticated users.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00472 · 39.9th percentile
Published
2026-06-26T06:00Z
EPSS history
Timeline
  • 26 JUN 06:00Z
    Frontend File Manager Plugin <= 23.6 - Author+ Arbitrary Post Deletion
    cvelistv5