CVE-2026-8379 — Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Download

CVE-2026-8379

Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Download PUBLISHED

Description (CNA)

The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly enforce its nonce check on the file download handler, allowing unauthenticated attackers to download files uploaded by any user through the Frontend File Manager Plugin WordPress plugin through 23.6 by iterating identifiers.

Affected (CNA)

Vendor / product	Versions
Unknown / Frontend File Manager Plugin	affected 0 through 23.6

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/71619406-19bb-437f-9538-fdf73de98827/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.