WordPress Frontend File Manager Plugin <= 23.6 Author+ Arbitrary File Deletion (CVE-2026-8380)

Vulnerability Overview Vulnerability Name: Frontend File Manager Plugin <= 23.6 - Author+ Arbitrary Post Deletion Description: The plugin fails to properly validate ownership of each target post, allowing users with author-level access to permanently delete arbitrary posts and pages. When the administrator enables the "Allow guest uploads" setting, the same deletion primitive becomes accessible to unauthenticated users. Scope Affected Plugin: nmedia-user-file-uploader Fix: No known fix available References CVE: CVE-2026-8380 Classification: Type: File Deletion OWASP Top 10: A6: Security Misconfiguration CWE: CWE-73 CVSS: 6.5 (Medium) Original Researcher: Tiago Ferreira Submitter: Tiago Ferreira Verification Status: Verified WPVDB ID: 45cbf74-45be-4cff-a81a-0fea903592a5 Timeline Public Disclosure Date: 2026-06-04 Date Added: 2026-05-28 Last Update Date: 2026-05-28 Others Release Date: 2023-03-28 Title: Easy Media Replace < 0.2.0 - Author+ File Deletion Release Date: 2025-11-24 Title: AI Engine for WordPress: ChatGPT, GPT Content Generator <= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read Release Date: 2025-07-14 Title: Alone - Charity Multipurpose Non-profit WordPress Theme < 7.8.7 - Missing Authorization to Unauthenticated Arbitrary File Deletion Release Date: 2026-05-06 Title: WP-Optimize < 4.5.3 - Author+ Arbitrary File Deletion via 'original-file' Post Meta Release Date: 2024-12-20 Title: SMSA Shipping(official) < 2.4 - Authenticated (Subscriber+) Arbitrary File Deletion Proof of Concept

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Frontend File Manager Plugin <= 23.6 Author+ Arbitrary File Deletion (CVE-2026-8380)

More from this source