CVE-2026-5337 Overview
CVE-2026-5337 is an Insecure Direct Object Reference (IDOR) vulnerability in the Frontend File Manager Plugin for WordPress through version 23.6. The plugin fails to validate user authorization when processing file download requests. Authenticated attackers with Subscriber-level access or higher can manipulate the file_id parameter in the download endpoint to access files belonging to other users, including administrators. This results in unauthorized read access to sensitive data stored within the application. The flaw is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.
Critical Impact
Low-privileged authenticated users can read arbitrary files uploaded by other WordPress users, including administrators, by enumerating the file_id parameter.
Affected Products
- Frontend File Manager Plugin for WordPress (versions through 23.6)
- WordPress sites running the vulnerable plugin with open registration or Subscriber accounts
- Any deployment exposing the wpfm_download action to authenticated users
Discovery Timeline
- 2026-05-03 - CVE-2026-5337 published to NVD
- 2026-05-04 - Last updated in NVD database
Technical Details for CVE-2026-5337
Vulnerability Analysis
The Frontend File Manager Plugin handles file downloads through the wpfm_download action. The endpoint accepts a file_id parameter that directly references the requested upload by its identifier. The plugin verifies that the requester is authenticated and that the nm_file_nonce value is valid, but it does not verify that the authenticated user owns or is otherwise authorized to access the referenced file. An attacker with any account level from Subscriber upward can iterate through file_id values and retrieve files uploaded by other accounts.
Root Cause
The root cause is missing object-level authorization. The plugin treats a valid session and a valid nonce as sufficient proof of access rights. It never compares the file_id owner against the current user, which is the defining pattern of [CWE-639]. Authorization decisions are delegated to a user-controllable parameter rather than enforced server-side against the authenticated principal.
Attack Vector
Exploitation requires only a valid Subscriber account, which is trivial on sites that allow self-registration. The attacker authenticates, retrieves a valid nm_file_nonce, then submits crafted requests of the form ?do=wpfm_download&file_id=<n>&nm_file_nonce=<token>, incrementing file_id to enumerate stored uploads. Each successful response returns the raw file contents associated with that identifier, regardless of the file's owner. No user interaction beyond the attacker's session is required, and the attack is performed entirely over the network.
No public proof-of-concept exploit is referenced in the advisory beyond the URL pattern documented in the WPScan Vulnerability Report.
Detection Methods for CVE-2026-5337
Indicators of Compromise
- Web server access log entries containing do=wpfm_download with sequential or non-monotonic file_id values from a single session.
- Repeated 200 OK responses to wpfm_download requests originating from Subscriber-level accounts.
- Outbound transfers of plugin upload directory content to a small number of authenticated client IPs.
Detection Strategies
- Correlate file_id values returned in responses with the WordPress user ID associated with each upload, and alert when these do not match the requesting user.
- Baseline normal wpfm_download request volume per user role and flag Subscriber accounts that exceed it.
- Inspect WordPress audit logs for newly registered Subscriber accounts followed by bursts of plugin download requests.
Monitoring Recommendations
- Enable verbose logging on the WordPress plugin and forward logs to a centralized SIEM for retention and correlation.
- Monitor for HTTP requests with rapidly changing file_id parameters originating from the same authenticated session.
- Alert on access to files owned by administrator accounts when the requesting session belongs to a non-administrator role.
How to Mitigate CVE-2026-5337
Immediate Actions Required
- Disable or uninstall the Frontend File Manager Plugin until a fixed version is installed.
- Audit existing WordPress accounts and remove unused or unknown Subscriber accounts.
- Disable open user registration on sites that do not require it by unchecking Anyone can register under WordPress general settings.
Patch Information
At the time of publication, the WPScan Vulnerability Report lists the plugin as vulnerable through version 23.6. Administrators should upgrade to a version released after 23.6 that explicitly addresses CVE-2026-5337 and verify the fix in the plugin changelog before redeploying.
Workarounds
- Restrict access to the wpfm_download endpoint at the web server or WAF layer to administrator IP ranges.
- Apply a WAF rule that blocks requests to ?do=wpfm_download originating from Subscriber-level sessions.
- Move sensitive uploads out of the plugin's managed directory and serve them through a separate, authorization-aware mechanism until patched.
# Example nginx rule blocking the vulnerable endpoint
location / {
if ($arg_do = "wpfm_download") {
return 403;
}
}
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
