nmedia Frontend File Manager Plugin up to 23.6 on WordPress AJAX wp-config.php sanitize_key wpfm_dir_path file inclusion

Summaryinfo

A vulnerability, which was classified as problematic, has been found in nmedia Frontend File Manager Plugin up to 23.6 on WordPress. The affected element is the function sanitize_key of the file wp-config.php of the component AJAX Handler. The manipulation of the argument wpfm_dir_path leads to file inclusion. This vulnerability is documented as CVE-2026-8095. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in nmedia Frontend File Manager Plugin up to 23.6 on WordPress. This issue affects the function sanitize_key of the file wp-config.php of the component AJAX Handler. The manipulation of the argument wpfm_dir_path with an unknown input leads to a file inclusion vulnerability. Using CWE to declare the problem leads to CWE-73. The product allows user input to control or influence paths or file names that are used in filesystem operations. Impacted is integrity, and availability. The summary by CVE is:

The Frontend File Manager Plugin plugin for WordPress is vulnerable to Authenticated Arbitrary File Deletion in versions up to and including 23.6. This is due to a case-sensitive bypass of the wpfm_dir_path parameter sanitization in the wpfm_file_meta_update AJAX handler, where supplying WPFM_DIR_PATH in uppercase evades the unset check and is normalized to wpfm_dir_path by sanitize_key() during update_post_meta(), allowing an attacker to overwrite the stored file path with an arbitrary filesystem path that is then passed directly to unlink() in delete_file_locally() without any directory containment validation. This makes it possible for authenticated attackers with Subscriber-level access to delete arbitrary files on the server, including sensitive files such as wp-config.php, potentially leading to full site takeover.

The weakness was released by sorawautsukushiii. The advisory is shared at wordfence.com. The identification of this vulnerability is CVE-2026-8095 since 05/07/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available.

By approaching the search of inurl:wp-config.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 23.6 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-39968). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• WordPress Plugin

Vendor

• nmedia

Name

• Frontend File Manager Plugin

Version

• 23.0
• 23.1
• 23.2
• 23.3
• 23.4
• 23.5
• 23.6

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion