Frontend File Manager Plugin: Arbitrary file deletion
Frontend File Manager Plugin is affected by arbitrary file deletion. Exploitation requires at least subscriber-level access. A successful request can remove files outside the intended scope and may make the site unavailable. The published affected range is <= 23.6.
- Component
- Frontend File Manager Plugin
- Plugin slug
nmedia-user-file-uploader- Affected
- <= 23.6
- Safe version
> 23.6- Published
- Jun 28, 2026
This CVE was published Jun 28, 2026 and is one of 9 known issues for this plugin.
Update, patch or deactivate.
Update Frontend File Manager Plugin to a release after 23.6, or disable and remove it until a fixed version is available.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Frontend File Manager Plugin plugin for WordPress is vulnerable to Authenticated Arbitrary File Deletion in versions up to and including 23.6. This is due to a case-sensitive bypass of the wpfm_dir_path parameter sanitization in the wpfm_file_meta_update AJAX handler, where supplying WPFM_DIR_PATH in uppercase evades the unset check and is normalized to wpfm_dir_path by sanitize_key() during update_post_meta(), allowing an attacker to overwrite the stored file path with an arbitrary filesystem path that is then passed directly to unlink() in delete_file_locally() without any directory containment validation. This makes it possible for authenticated attackers with Subscriber-level access to delete arbitrary files on the server, including sensitive files such as wp-config.php, potentially leading to full site takeover.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H