Executive brief
The Frontend File Manager plugin for WordPress, which allows users to upload and manage files, contains a security flaw that allows anyone to delete files from the web server without logging in. By deleting critical system files like the site configuration, an attacker can force the website into a setup mode and take full control of the site. This vulnerability is particularly dangerous if the plugin's 'guest upload' feature is enabled.
Technical details
The Frontend File Manager plugin (nmedia-user-file-uploader) fails to properly validate or sanitize file paths derived from user input before passing them to file deletion functions. This path traversal vulnerability allows unauthenticated attackers to delete arbitrary files on the server if 'guest upload' mode is enabled. A common exploitation path involves deleting the 'wp-config.php' file, which triggers the WordPress installation wizard, allowing the attacker to reconnect the site to a database under their control and gain administrative access. As of the advisory date, no official patch has been released.
Affected products
- nmedia Frontend File Manager Plugin (nmedia-user-file-uploader) <= 23.6
Timeline
- 2026-06-16: disclosed: Publicly published by WPScan
- 2026-07-07: advisory: NVD entry published