CVE-2026-8095

Name of the Vulnerable Software and Affected Versions Frontend File Manager Plugin versions prior to 23.7

Description Authenticated users with Subscriber-level access can delete arbitrary files on the server, including sensitive files like wp-config.php, which may lead to a full site takeover. The issue occurs in the wpfm file meta update AJAX handler due to a case-sensitive bypass of the wpfm dir path parameter sanitization. By providing the parameter as WPFM DIR PATH in uppercase, the unset check is evaded, and the value is later normalized to wpfm dir path by the sanitize key() function during update post meta(). This allows the stored file path to be overwritten with an arbitrary filesystem path, which is then passed to the unlink() function within delete file locally() without directory containment validation.

Recommendations Update to the latest version. As a temporary mitigation, restrict access to the wpfm file meta update AJAX handler for users with Subscriber-level permissions.