PT-2026-8399 · WordPress · Frontend File Manager

Publicado 2026-02-17 · Atualizado 2026-02-25 · CVE-2026-0829

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Frontend File Manager plugin versions through 23.5

Description The Frontend File Manager plugin allows unauthenticated users to send emails through the WordPress site without security checks. This enables attackers to utilize the site as an open relay for spam or phishing emails. Attackers can also attempt to guess file IDs to access and share uploaded files without authorization, potentially exposing sensitive information.

Recommendations Update the plugin to a version newer than 23.5. Remove the plugin if an update is not available.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-0829

Produtos afetados

Frontend File Manager

Referências · 6

• 🔥 https://wpscan.com/vulnerability/57d62cea-cfb8-4421-a209-e64a015ad225 · Exploit
• https://twitter.com/offseq/status/2023661264937865506 · Publicação no Twitter
• https://t.me/CVEtracker/44861 · Publicação no Telegram
• https://t.me/cveNotify/152144 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-0829 · Nota de Segurança
• https://twitter.com/pdnuclei_bot/status/2026537680503452043 · Publicação no Twitter