Tiago Ferreira

**Name of the Vulnerable Software and Affected Versions** Frontend File Manager Plugin versions prior to 23.7 **Description** The plugin fails to properly verify ownership of targeted posts before permanent deletion. This allows authenticated users with author-level access or higher to permanently delete arbitrary posts and pages. Additionally, if an administrator enables the "Allow guest uploads" setting, unauthenticated users can also perform this deletion action. **Recommendations** Update the plugin to a version newer than 23.6. Disable the "Allow guest uploads" setting to prevent unauthenticated users from exploiting the issue.