PT-2026-5093 · WordPress · Frontend File Manager Plugin

Md. Moniruzzaman Prodhan + 1 · Publicado 2026-01-28 · Atualizado 2026-01-28 · CVE-2026-1280

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Frontend File Manager Plugin for WordPress versions prior to 23.6

Description The Frontend File Manager Plugin for WordPress has a flaw that allows unauthorized file sharing. This is due to a missing check to ensure proper user permissions when handling the 'wpfm send file in email' AJAX action. An attacker can exploit this to share any uploaded file via email by providing a file ID. Because file IDs are sequential integers, attackers can potentially list all uploaded files and obtain sensitive data intended for administrators only. The vulnerable component is the wpfm send file in email AJAX action.

Recommendations Update to version 23.6 or later.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-1280

Produtos afetados

Frontend File Manager Plugin

Referências · 7

• https://t.me/CVEtracker/43135 · Publicação no Telegram
• https://wordfence.com/threat-intel/vulnerabilities/id/e739e7d3-756a-4c93-9ca7-f7b9f9657033?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/nmedia-user-file-uploader/tags/23.5/inc/callback-functions.php#L98 · Nota
• https://plugins.trac.wordpress.org/browser/nmedia-user-file-uploader/trunk/inc/callback-functions.php#L98 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-1280 · Nota de Segurança
• https://t.me/cveNotify/150126 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2016478171877581115 · Publicação no Twitter