CVE-2025-14804: falha de alta gravidade em Frontend File Manager Plugin
Frontend File Manager < 23.5 - Subscriber+ Arbitrary File Deletion
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.7epss 0.3%
The Frontend File Manager Plugin WordPress plugin before 23.5 did not validate a path parameter and ownership of the file, allowing any authenticated users, such as subscribers to delete arbitrary files on the server
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Produtos afetados
Unknown · Frontend File Manager PluginCVEs relacionadas — Frontend File Manager Plugin
No mesmo produto, das mais perigosas para as menos.
CVE-2022-3124—Frontend File Manager < 21.3 - Unauthenticated File RenamingEPSS 8.3%CVE-2022-3125—Frontend File Manager < 21.3 - Subscriber+ Arbitrary File UploadEPSS 1.6%CVE-2023-5105—Frontend File Manager < 22.6 - Editor+ Arbitrary File DownloadEPSS 1.0%CVE-2026-0829MEDIUMFrontend File Manager Plugin <= 23.5 - Unauthenticated Arbitrary Email SendingEPSS 0.7%CVE-2026-8380MEDIUMFrontend File Manager Plugin <= 23.6 - Author+ Arbitrary Post DeletionEPSS 0.5%CVE-2026-8379HIGHFrontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File DownloadEPSS 0.4%