PT-2026-1562 · WordPress · Frontend File Manager Plugin
CVE-2025-14804
·
Published
2026-01-07
·
Updated
2026-01-12
CVSS v3.1
7.7
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Frontend File Manager Plugin versions prior to 23.5
Description
The Frontend File Manager Plugin for WordPress did not properly check a file path and who owned the file. This allowed any logged-in user, even those with limited permissions like subscribers, to delete any file on the server.
Recommendations
Update to version 23.5 or later.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Frontend File Manager Plugin