PT-2026-36684 · WordPress · Frontend File Manager Plugin

Published 2026-05-03 · Updated 2026-05-03 · CVE-2026-5337

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Frontend File Manager Plugin WordPress versions prior to 23.7

Description Authenticated attackers with Subscriber-level access or higher can perform an Insecure Direct Object Reference (IDOR) attack, which occurs when an application provides direct access to objects based on user-supplied input. The issue exists because the plugin fails to properly validate user authorization for requested uploaded files during download requests. By modifying the file id parameter in the 'do=wpfm download' endpoint, an attacker can gain unauthorized read access to sensitive files belonging to other users, including administrators.

Recommendations Update the plugin to a version later than 23.6. As a temporary workaround, restrict access to the 'do=wpfm download' endpoint or the file id parameter to minimize the risk of unauthorized file access.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-5337

Affected Products

Frontend File Manager Plugin

References · 6

• 🔥 https://wpscan.com/vulnerability/3e28aa78-3227-474a-b1db-1f5ea2c42d14 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5337 · Security Note
• https://t.me/CVEtracker/52561 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2050847950696231267 · Twitter Post
• https://twitter.com/CVEnew/status/2050854479566692646 · Twitter Post
• https://twitter.com/infoflowcloud/status/2050855682560168149 · Twitter Post