Vulnerability · Published Aug 2, 2026 · Assigned by WPScan

CVE-2026-16292Frontend File Manager Plugin <= 23.6 - File Metadata Update via CSRF

Medium 5.4

In plain English

A medium-severity cross-site request forgery in Frontend File Manager Plugin from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.1%top 97.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The Frontend File Manager Plugin WordPress plugin through 23.6 does not perform nonce validation on one of its file-metadata update actions, allowing an attacker to modify the metadata of a logged-in user's uploaded file via a CSRF attack, which can be leveraged to download that file. When guest uploads are enabled, the same action is reachable unauthenticated against any user's file.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Frontend File Manager Plugin	0 – through 23.6

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References

https://wpscan.com/vulnerability/7c0a8f6e-c460-4157-9ed9-3c5e9b1f1591/ exploit, vdb-entry, technical-description