CVE-2026-8380: Frontend File Manager Plugin Auth Bypass

CVE-2026-8380 Overview

CVE-2026-8380 is a broken access control vulnerability in the Frontend File Manager Plugin for WordPress through version 23.6. The plugin fails to verify post ownership before executing permanent deletion operations. Authenticated users with author-level privileges or higher can permanently delete arbitrary posts and pages belonging to other users. When an administrator enables the plugin's Allow guest uploads setting, the same deletion primitive becomes reachable by unauthenticated attackers over the network.

Critical Impact
Attackers can permanently delete arbitrary WordPress posts and pages, causing content loss and site integrity impact. With guest uploads enabled, exploitation requires no authentication.

Affected Products

Frontend File Manager Plugin for WordPress, versions through 23.6

Discovery Timeline

2026-06-26 - CVE-2026-8380 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-8380

Vulnerability Analysis

The Frontend File Manager Plugin exposes a deletion endpoint that acts on arbitrary post identifiers submitted by the requester. The handler removes the target post without validating that the requester owns the referenced post or possesses WordPress capabilities such as delete_others_posts. This produces a broken access control condition where the deletion primitive operates on any post_id value the caller supplies.

The vulnerability affects integrity and availability of site content. Deleted posts and pages are removed permanently rather than moved to the trash, so recovery depends on database backups. The absence of ownership checks combines with an existing plugin feature to create two distinct exploitation classes tied to plugin configuration.

Root Cause

The root cause is missing authorization enforcement in the plugin's post deletion path. Standard WordPress deletion workflows require capability checks tied to the acting user and the target object. The plugin's handler omits these checks and proceeds directly to permanent removal, treating the caller-supplied post_id as authoritative.

Attack Vector

Exploitation is performed over the network against the WordPress site. In the default configuration, an attacker needs an account with author-level access or higher. The attacker submits a crafted request to the plugin's deletion endpoint referencing a target post_id owned by another user, including administrators. When the Allow guest uploads setting is enabled by an administrator, the deletion primitive is reachable without authentication, allowing anonymous attackers to remove arbitrary content.

No verified proof-of-concept code is publicly available at the time of publication. Refer to the WPScan Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-8380

Indicators of Compromise

Unexplained deletion of posts, pages, or custom post types owned by administrators or editors.
HTTP POST requests to the Frontend File Manager Plugin action endpoints referencing post_id values the requester does not own.
Requests to plugin deletion actions originating from author-role accounts or unauthenticated sessions when guest uploads are enabled.

Detection Strategies

Review WordPress activity logs for wp_delete_post events initiated by users lacking the delete_others_posts capability.
Correlate web server access logs with WordPress user roles to identify author-level accounts invoking deletion actions against posts owned by other users.
Alert on any deletion action invoked without a valid authenticated session when the plugin is installed with guest uploads enabled.

Monitoring Recommendations

Enable a WordPress audit logging plugin to record post lifecycle events, including deletions and the acting user.
Monitor changes to the plugin's Allow guest uploads configuration and flag any administrator who enables it.
Track post count and identifier gaps over time to detect abnormal deletion patterns.

How to Mitigate CVE-2026-8380

Immediate Actions Required

Update the Frontend File Manager Plugin to a version later than 23.6 once the vendor publishes a patched release.
Disable the Allow guest uploads setting to remove the unauthenticated exploitation path.
Audit author-level and higher accounts, disabling any that are unused or unverified.

Patch Information

The vulnerability affects the Frontend File Manager Plugin through version 23.6. Administrators should track the plugin listing on the WordPress.org repository and the WPScan Vulnerability Report for a fixed release that adds ownership and capability validation to the deletion handler.

Workarounds

Deactivate the Frontend File Manager Plugin until a fixed version is available if the plugin is not essential.
Restrict access to the plugin's frontend endpoints using a web application firewall rule that blocks deletion actions from unauthenticated users.
Downgrade site accounts from author to contributor where publishing rights are not required, reducing the population able to reach the deletion primitive.

bash

# Configuration example: disable the plugin site-wide using WP-CLI
wp plugin deactivate frontend-file-manager-plugin

# Verify deactivation
wp plugin status frontend-file-manager-plugin