PT-2026-5093 · WordPress · Frontend File Manager Plugin

Md. Moniruzzaman Prodhan + 1 · Published 2026-01-28 · Updated 2026-01-28 · CVE-2026-1280

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Frontend File Manager Plugin for WordPress versions prior to 23.6

Description The Frontend File Manager Plugin for WordPress has a flaw that allows unauthorized file sharing. This is due to a missing check to ensure proper user permissions when handling the 'wpfm send file in email' AJAX action. An attacker can exploit this to share any uploaded file via email by providing a file ID. Because file IDs are sequential integers, attackers can potentially list all uploaded files and obtain sensitive data intended for administrators only. The vulnerable component is the wpfm send file in email AJAX action.

Recommendations Update to version 23.6 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-1280

Affected Products

Frontend File Manager Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-1280 · Security Note
• https://t.me/CVEtracker/43135 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/e739e7d3-756a-4c93-9ca7-f7b9f9657033?source=cve · Note
• https://plugins.trac.wordpress.org/browser/nmedia-user-file-uploader/tags/23.5/inc/callback-functions.php#L98 · Note
• https://plugins.trac.wordpress.org/browser/nmedia-user-file-uploader/trunk/inc/callback-functions.php#L98 · Note
• https://t.me/cveNotify/150126 · Telegram Post
• https://twitter.com/CVEnew/status/2016478171877581115 · Twitter Post