PT-2026-1562
CVE-2025-14804
·
Published
2025-12-17
·
Updated
2026-09-30
Description by
CVSS 3.1
7.7
HighMetricsAV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions
Frontend File Manager Plugin versions prior to 23.5
Description
The Frontend File Manager Plugin for WordPress did not properly check a file path and who owned the file. This allowed any logged-in user, even those with limited permissions like subscribers, to delete any file on the server.
Recommendations
Update to version 23.5 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾