Executive brief
The Frontend File Manager plugin for WordPress, which allows users to upload and manage files from the website's front end, contains a security flaw that allows logged-in users to delete files they should not have access to. By exploiting this vulnerability, even a low-level user like a subscriber could delete critical system files such as the website's configuration file. This can lead to a complete shutdown of the website or allow an attacker to take full control of the site.
Technical details
The Frontend File Manager plugin for WordPress is vulnerable to authenticated arbitrary file deletion in versions up to 23.6 due to a case-sensitive bypass in the wpfm_file_meta_update AJAX handler. An attacker can supply the 'wpfm_dir_path' parameter in uppercase (WPFM_DIR_PATH) to evade an unset check; this value is subsequently normalized by sanitize_key() during update_post_meta(). The resulting arbitrary filesystem path is then passed to the unlink() function in delete_file_locally() without directory containment validation. Authenticated attackers with Subscriber-level permissions can exploit this to delete critical files like wp-config.php, facilitating a complete site compromise.
Affected products
- nMedia Frontend File Manager Plugin up to and including 23.6
Timeline
- 2026-06-28: advisory: Initial disclosure date