PT-2026-8399 · WordPress · Frontend File Manager

Published 2026-02-17 · Updated 2026-02-25 · CVE-2026-0829

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Frontend File Manager plugin versions through 23.5

Description The Frontend File Manager plugin allows unauthenticated users to send emails through the WordPress site without security checks. This enables attackers to utilize the site as an open relay for spam or phishing emails. Attackers can also attempt to guess file IDs to access and share uploaded files without authorization, potentially exposing sensitive information.

Recommendations Update the plugin to a version newer than 23.5. Remove the plugin if an update is not available.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-0829

Affected Products

Frontend File Manager

References · 6

• 🔥 https://wpscan.com/vulnerability/57d62cea-cfb8-4421-a209-e64a015ad225 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-0829 · Security Note
• https://twitter.com/offseq/status/2023661264937865506 · Twitter Post
• https://t.me/CVEtracker/44861 · Telegram Post
• https://t.me/cveNotify/152144 · Telegram Post
• https://twitter.com/pdnuclei_bot/status/2026537680503452043 · Twitter Post