Frontend File Manager Plugin <= 23.6 - Authenticated (Subscriber+) Arbitrary File Deletion
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
The Frontend File Manager Plugin plugin for WordPress is vulnerable to Authenticated Arbitrary File Deletion in versions up to and including 23.6. This is due to a case-sensitive bypass of the wpfm_dir_path parameter sanitization in the wpfm_file_meta_update AJAX handler, where supplying WPFM_DIR_PATH in uppercase evades the unset check and is normalized to wpfm_dir_path by sanitize_key() during update_post_meta(), allowing an attacker to overwrite the stored file path with an arbitrary filesystem path that is then passed directly to unlink() in delete_file_locally() without any directory containment validation. This makes it possible for authenticated attackers with Subscriber-level access to delete arbitrary files on the server, including sensitive files such as wp-config.php, potentially leading to full site takeover.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nmedia | Frontend File Manager Plugin | up to 23.6 | — | No fix listed | CNA |
- Frontend File Manager Plugin Vendornmedia Affected up to 23.6 Fixed in — No fix listed CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:najeebmedia:frontend_file_manager_plugin:*:*:*:*:*:*:*:* | — | — | Najeebmedia |
- cpe:2.3:a:najeebmedia:frontend_file_manager_plugin:*:*:*:*:*:*:*:* Versions — — ·Najeebmedia
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-8095
- 2026-10-03 Alias added: GHSA-hhrc-vf2p-x5h3
References
Other 3
- https://www.wordfence.com/threat-intel/vulnerabilities/id/506006ce-7b1c-4f9d-93f3-abc87abea2bb?source=cve
- https://plugins.trac.wordpress.org/browser/nmedia-user-file-uploader/tags/23.6/inc/files.php#L767
- https://plugins.trac.wordpress.org/browser/nmedia-user-file-uploader/tags/23.6/inc/file.class.php#L729
More nmedia vulnerabilities
- TI-2016-09162 Frontend File Manager < 4.0 & N-Media Post Front-end Form < 1.1 & - Arbitrary File Upload CVSS 3.1CRITICAL 9.8
- TI-2025-03863 Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation CVSS 3.1CRITICAL 9.8
- TI-2024-22153 WordPress OrderConvo plugin <= 12.4 - Unauthenticated API Access to Arbitrary File Upload vulnerability CVSS 3.1CRITICAL 10.0
- TI-2024-33090 WordPress Simple User Registration plugin <= 6.7 - Broken Authentication vulnerability CVSS 3.1CRITICAL 9.8
- TI-2015-08065 Website Contact Form With File Upload <= 1.3.4 - Arbitrary File Upload CVSS 3.1CRITICAL 9.8
- TI-2012-03100 Unrestricted file upload vulnerability in doupload.php in the Nmedia Member Conversation… CVSS 2.0HIGH 7.5
Sources
- CVE-2026-8095 · CVE Program
- CVE-2026-8095 · NVD
- FIRST EPSS
- GHSA-hhrc-vf2p-x5h3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences