WordPress security by component

Frontend File Manager Plugin

Plugin description

Frontend File Manager Plugin provides front-end tools for uploading, browsing, organizing, and managing files within WordPress websites.

Frontend File Manager Plugin (frontend-file-manager-plugin) is a WordPress plugin with 19 published CVE records in this archive. The latest tracked vulnerability was published Aug 02, 2026; the highest published CVSS base score is 9.9.

Plugin slug: frontend-file-manager-plugin

Latest vulnerability

CVE-2026-16292: Frontend File Manager metadata changes can expose other users' files

Frontend File Manager Plugin through 23.6 omits nonce validation from a file-metadata update operation. An attacker can use CSRF to change metadata on a logged-in user's uploaded file and leverage that change to download the file; when guest uploads are enabled, the same operation is directly reachable without authentication against any user's file.

PublishedAug 02, 2026

Known safe version> 23.6

Published vulnerabilities for frontend-file-manager-plugin
		Safe version
Aug 02, 2026	CVE-2026-16292 Frontend File Manager metadata changes can expose other users' files Frontend File Manager Plugin through 23.6 omits nonce validation from a file-metadata update operation. An attacker can use CSRF to change metadata on a logged-in user's uploaded file and leverage that change to download the file; when guest uploads are enabled, the same operation is directly reachable without authentication against any user's file.	> 23.6	CVE5.4 NVDPending
Jul 07, 2026	CVE-2026-12277 Frontend File Manager Plugin: Arbitrary file deletion Frontend File Manager Plugin is affected by arbitrary file deletion. The vulnerable path is reachable without authentication. A successful request can remove files outside the intended scope and may make the site unavailable. The published affected range is <= 23.6.	See mitigation notes	CVE8.7 NVDPending
Jun 26, 2026	CVE-2026-8380 Frontend File Manager Plugin: A security weakness Frontend File Manager Plugin is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 23.6.	See mitigation notes	CVE6.5 NVDPending
Jun 23, 2026	CVE-2026-8379 Frontend File Manager Plugin: A security weakness Frontend File Manager Plugin is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 23.6.	See mitigation notes	CVE7.5 NVDPending
Jun 23, 2026	CVE-2026-8378 Frontend File Manager Plugin: Cross-site scripting Frontend File Manager Plugin is affected by cross-site scripting. Exploitation requires an authenticated subscriber account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 23.6.	See mitigation notes	CVE5.4 NVDPending
May 03, 2026	CVE-2026-5337 Frontend File Manager Plugin: Broken access control Frontend File Manager Plugin is affected by broken access control. Exploitation requires an authenticated subscriber account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is <= 23.6.	See mitigation notes	CVE6.5 NVDPending
Feb 17, 2026	CVE-2026-0829 Frontend File Manager Plugin: A security weakness Frontend File Manager Plugin is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.8 NVDPending
Jan 07, 2026	CVE-2025-14804 Frontend File Manager Plugin: Arbitrary file deletion Frontend File Manager Plugin is affected by arbitrary file deletion. Exposure depends on how the affected operation is made reachable by the site. A successful request can remove files outside the intended scope and may make the site unavailable.	See mitigation notes	CVE7.7 NVDPending
Jul 25, 2025	CVE-2023-7306 Frontend File Manager Plugin: A security weakness Frontend File Manager Plugin is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE7.5 NVDPending
Dec 04, 2023	CVE-2023-5105 Frontend File Manager Plugin: A security weakness Frontend File Manager Plugin is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVEPending NVD6.5
Jun 07, 2023	CVE-2021-4369 Frontend File Manager: A security weakness Frontend File Manager is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.8 NVD5.3
Jun 07, 2023	CVE-2021-4368 Frontend File Manager: Code execution Frontend File Manager is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.	See mitigation notes	CVE9.9 NVD8.8
Jun 07, 2023	CVE-2021-4365 Frontend File Manager: Cross-site scripting Frontend File Manager is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE7.2 NVD6.1
Jun 07, 2023	CVE-2021-4359 Frontend File Manager: A security weakness Frontend File Manager is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE6.5 NVD5.3
Jun 07, 2023	CVE-2021-4356 Frontend File Manager: Unauthorized file download Frontend File Manager is affected by unauthorized file download. The vulnerable path is reachable without authentication. A successful request can download a file that the caller should not be permitted to access.	See mitigation notes	CVE9.0 NVD9.8
Jun 07, 2023	CVE-2021-4351 Frontend File Manager: A security weakness Frontend File Manager is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.8 NVD5.3
Jun 07, 2023	CVE-2021-4350 Frontend File Manager: A security weakness Frontend File Manager is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE7.2 NVD5.3
Jun 07, 2023	CVE-2021-4344 Frontend File Manager: Privilege escalation or authentication bypass Frontend File Manager is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess.	See mitigation notes	CVE6.4 NVD5.4
Oct 17, 2022	CVE-2022-3126 Frontend File Manager Plugin: Cross-site request forgery Frontend File Manager Plugin is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE4.3 NVD4.3

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers