What’s Vulnerable › Vulnerabilities
CVE-2026-8380: Frontend File Manager Plugin <= 23.6 - Author+ Arbitrary Post Deletion
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-26 · updated 2026-06-26
Description
The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly verify ownership of every targeted post before permanent deletion, allowing authenticated users with author-level access and above to permanently delete arbitrary posts and pages. When the Frontend File Manager Plugin WordPress plugin through 23.6's "Allow guest uploads" setting is enabled by an administrator, the same deletion primitive becomes reachable by unauthenticated users.
Affected products
- Frontend File Manager Plugin: through 23.6
References
Get alerted when CVE-2026-8380 or the next vulnerability affects your stack