Skip to content
Threat Feed

Product

Frontend File Manager (Nmedia-User-File-Uploader) <= 23.6

1 brief RSS
critical threat

CVE-2026-8380: WordPress Frontend File Manager Arbitrary Post Deletion

CVE-2026-8380 is a critical authorization bypass vulnerability in the WordPress Frontend File Manager plugin <= 23.6 that allows authenticated low-privilege users, or unauthenticated users with guest uploads enabled, to permanently delete arbitrary WordPress posts, pages, attachments, and custom post types.

Frontend File Manager cve wordpress authorization privilege-escalation arbitrary-deletion plugin-vulnerability
2r 1t