CVE-2026-8095: WordPress File Manager Auth Bypass Flaw

CVE-2026-8095 Overview

CVE-2026-8095 is an authenticated arbitrary file deletion vulnerability in the Frontend File Manager Plugin for WordPress, affecting versions up to and including 23.6. Attackers with Subscriber-level access can exploit a case-sensitive parameter sanitization bypass in the wpfm_file_meta_update AJAX handler to overwrite the stored file path. The overwritten path is passed directly to unlink() without directory containment checks, enabling deletion of arbitrary files on the server. Deleting sensitive files such as wp-config.php can trigger the WordPress setup flow, leading to full site takeover [CWE-73].

Critical Impact
Authenticated Subscriber accounts can delete wp-config.php and other sensitive files, enabling site takeover on any WordPress installation running the vulnerable plugin.

Affected Products

Frontend File Manager Plugin (nmedia-user-file-uploader) for WordPress
All versions up to and including 23.6
WordPress sites permitting Subscriber-level registration

Discovery Timeline

2026-06-28 - CVE-2026-8095 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-8095

Vulnerability Analysis

The Frontend File Manager Plugin exposes an AJAX endpoint, wpfm_file_meta_update, that updates post meta associated with uploaded files. The handler attempts to prevent tampering with the wpfm_dir_path meta key by calling unset() on the incoming parameter. The unset() check is case-sensitive and only removes the lowercase key.

An attacker supplies the parameter as WPFM_DIR_PATH in uppercase. The unset routine misses the uppercase variant, and the value is later passed to update_post_meta(). WordPress normalizes meta keys using sanitize_key(), which lowercases the string and stores the attacker-controlled value under wpfm_dir_path.

When the plugin subsequently invokes delete_file_locally(), it reads the poisoned meta value and passes it directly to unlink(). No directory containment or realpath validation is performed, so any file readable by the web server user can be deleted. This includes wp-config.php, .htaccess, plugin files, and cron scripts.

Root Cause

The root cause is inconsistent case handling between the plugin's input filter and the WordPress meta API. The plugin filters lowercase keys, but sanitize_key() folds case after the check, defeating the block-list. This category of flaw is tracked as external control of file name or path [CWE-73].

Attack Vector

Exploitation requires only a valid low-privileged WordPress account. The attacker submits a crafted POST request to admin-ajax.php targeting action=wpfm_file_meta_update with WPFM_DIR_PATH set to an absolute path such as /var/www/html/wp-config.php. A follow-up delete request triggers unlink() against that path. Deleting wp-config.php causes WordPress to re-enter the installation wizard, allowing the attacker to reconfigure the database and seize administrative control.

See the WordPress Plugin Code Review at file.class.php and files.php for the vulnerable code paths.

Detection Methods for CVE-2026-8095

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing action=wpfm_file_meta_update with parameters whose names use mixed or uppercase casing, such as WPFM_DIR_PATH.
Absolute filesystem paths appearing in AJAX request bodies, particularly paths outside the WordPress uploads directory.
Missing or recently deleted wp-config.php, .htaccess, or plugin bootstrap files without administrator action.
Unexpected appearance of the WordPress installation wizard (/wp-admin/install.php) on a production site.

Detection Strategies

Inspect web server access logs for wpfm_file_meta_update requests originating from Subscriber-level user sessions.
Correlate WordPress postmeta entries where meta_key = 'wpfm_dir_path' contains absolute paths outside the uploads directory.
Alert on file integrity monitoring events for deletion of core WordPress configuration files.

Monitoring Recommendations

Enable file integrity monitoring on wp-config.php, .htaccess, and the wp-content/plugins/ tree.
Log all authenticated AJAX activity from non-administrator accounts and review high-volume actors.
Track new Subscriber registrations followed by rapid AJAX requests to the file manager endpoint.

How to Mitigate CVE-2026-8095

Immediate Actions Required

Update the Frontend File Manager Plugin to a version above 23.6 as soon as a patched release is available from the vendor.
Disable or remove the plugin on sites that permit open Subscriber registration until a fix is applied.
Disable open user registration by unchecking Settings → General → "Anyone can register" where practical.
Audit postmeta for wpfm_dir_path values referencing paths outside wp-content/uploads/ and remove anomalous entries.

Patch Information

At the time of publication, refer to the Wordfence Vulnerability Report for patch status and fixed versions. Apply the vendor-supplied update once available and verify that the wpfm_file_meta_update handler rejects case variants of wpfm_dir_path.

Workarounds

Block requests to admin-ajax.php where action=wpfm_file_meta_update originates from Subscriber-level accounts using a Web Application Firewall (WAF) rule.
Reject POST parameters matching wpfm_dir_path in any case (case-insensitive regex) that contain absolute path characters such as / or \.
Restrict PHP open_basedir to the WordPress document root so unlink() cannot reach sensitive system paths.

bash

# Example ModSecurity rule to block case-variant parameter abuse
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:2026809501,\
     msg:'CVE-2026-8095 wpfm_dir_path bypass attempt'"
    SecRule ARGS_NAMES "@rx (?i)wpfm_dir_path" \
        "chain"
        SecRule ARGS:action "@streq wpfm_file_meta_update"