CVE-2026-8379high

CVE-2026-8379: falha de alta gravidade em Frontend File Manager Plugin

Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Download

Publicada em

Seguir esta CVE+ Monitorar Frontend File Manager Plugin

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

41Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 7.5epss 0.4%
The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly enforce its nonce check on the file download handler, allowing unauthenticated attackers to download files uploaded by any user through the Frontend File Manager Plugin WordPress plugin through 23.6 by iterating identifiers.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
Unknown · Frontend File Manager Plugin
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Frontend File Manager Plugin

No mesmo produto, das mais perigosas para as menos.

CVE-2022-3124—Frontend File Manager < 21.3 - Unauthenticated File RenamingEPSS 8.3%CVE-2022-3125—Frontend File Manager < 21.3 - Subscriber+ Arbitrary File UploadEPSS 1.6%CVE-2023-5105—Frontend File Manager < 22.6 - Editor+ Arbitrary File DownloadEPSS 1.0%CVE-2026-0829MEDIUMFrontend File Manager Plugin <= 23.5 - Unauthenticated Arbitrary Email SendingEPSS 0.7%CVE-2026-8380MEDIUMFrontend File Manager Plugin <= 23.6 - Author+ Arbitrary Post DeletionEPSS 0.5%CVE-2026-12277HIGHFrontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Deletion via Saved File Metadata Path TraversalEPSS 0.4%