CVE-2026-8095 Details

A vulnerability allowing authenticated users to delete arbitrary files has been identified in the Frontend File Manager Plugin for WordPress, affecting versions through 23.6. This issue arises from a case-sensitive bypass in the sanitization of the 'wpfm_dir_path' parameter within the 'wpfm_file_meta_update' AJAX handler. By supplying 'WPFM_DIR_PATH' in uppercase, the unset check is evaded, and the path is normalized to 'wpfm_dir_path' using 'sanitize_key()' during 'update_post_meta()'. This allows an attacker to overwrite the stored file path with an arbitrary filesystem path, which is then passed directly to 'unlink()' in 'delete_file_locally()' without any directory containment validation. As a result, authenticated attackers with Subscriber-level access can delete any file on the server, including sensitive files like 'wp-config.php', potentially leading to a complete takeover of the site.

No known patch is available for this vulnerability. It is recommended to review the vulnerability details thoroughly and consider uninstalling the affected plugin.