CVE-2026-16292

Name of the Vulnerable Software and Affected Versions Frontend File Manager Plugin versions prior to 23.7

Description The plugin fails to perform nonce validation—a security measure used to protect against Cross-Site Request Forgery (CSRF), where a user is tricked into executing unwanted actions—on a file-metadata update action. This allows an attacker to modify the metadata of files uploaded by logged-in users via a CSRF attack, which can subsequently be used to download those files. If guest uploads are enabled, this action can be performed by unauthenticated users against any user's file.

Recommendations Update the plugin to a version newer than 23.6.