CVE-2026-16292 in Frontend File Manager Plugin
Zusammenfassung
von MITRE • 02.08.2026
The Frontend File Manager Plugin WordPress plugin through 23.6 does not perform nonce validation on one of its file-metadata update actions, allowing an attacker to modify the metadata of a logged-in user's uploaded file via a CSRF attack, which can be leveraged to download that file. When guest uploads are enabled, the same action is reachable unauthenticated against any user's file.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.