CVE-2026-12277: Frontend File Manager Plugin Arbitrary File Deletion (WordPress)

Technical summary

CVE-2026-12277 is a path traversal and arbitrary file deletion vulnerability in the Frontend File Manager Plugin. The plugin fails to properly validate or sanitize file path parameters supplied by users before executing file deletion operations. When guest upload mode is enabled, this validation gap is exploitable by unauthenticated attackers. The vulnerability allows deletion of arbitrary files accessible to the web server process, including critical WordPress configuration files. Successful deletion of wp-config.php—which stores database connection details, authentication salts, and other sensitive configuration—forces WordPress into its installation routine, creating an authentication bypass and administrative access opportunity.

Business impact

Sites running affected versions of Frontend File Manager with guest uploads enabled face immediate risk of service disruption and complete compromise. An attacker deleting wp-config.php will render the site non-functional and force it into setup mode, during which an attacker can reconfigure the database credentials, create admin accounts, and establish persistence. This translates to data theft, defacement, malware injection, and loss of customer trust. Organizations operating multi-tenant or SaaS environments using this plugin face elevated risk due to the potential for lateral movement and supply-chain impact.

Affected systems

WordPress installations running the Frontend File Manager Plugin version 23.6 and earlier are vulnerable. The attack surface is limited to sites that have explicitly enabled the plugin's guest upload mode feature. Sites with guest uploads disabled are not affected by this vulnerability. The plugin's popularity in WordPress ecosystems means exposure could be widespread among content-heavy or community-driven sites.

Exploitability

This vulnerability is highly exploitable. No authentication is required, the attack is network-based, and exploitation requires only moderate complexity (guest upload mode must be enabled). An attacker needs only to craft a malicious file deletion request targeting wp-config.php or other critical files. The CVSS 3.1 score of 8.7 reflects high integrity and availability impact across scope boundaries. However, the requirement that guest upload mode be active limits the immediate threat surface to a subset of deployed instances. Active exploitation is not yet reported in the wild, but the simplicity of the attack and high impact make it a prime candidate for rapid weaponization.

Remediation

Immediate actions: disable guest upload mode in the Frontend File Manager Plugin settings if it is not essential to site operations. This eliminates the unauthenticated attack vector entirely. Long-term: update the plugin to a patched version once the vendor releases a security fix. Verify the fix includes proper input validation and path canonicalization before file operations. Consider restricting file deletion operations to authenticated administrators only, and implement a whitelist of directories where deletions are permitted. Monitor plugin release notes and vendor security advisories for patch availability.

Patch guidance

Check the Frontend File Manager Plugin's official WordPress.org plugin page and the vendor's security advisories for version 23.7 or later, which should contain the patched code. Apply patches immediately upon availability to all affected installations. Before patching, implement the temporary mitigation of disabling guest upload mode to eliminate exploitation risk. After patching, re-enable guest uploads only if necessary and conduct a file integrity check to ensure no unauthorized modifications occurred during the vulnerability window. Test patches in a staging environment before production deployment.

Detection guidance

Monitor web server logs for DELETE requests or POST requests targeting the plugin's file manager endpoints, particularly those containing path traversal sequences (../) or references to critical files (wp-config.php, .htaccess). Use WordPress security plugins (e.g., Wordfence, Sucuri) to scan for the Frontend File Manager Plugin and flag instances with guest uploads enabled. File integrity monitoring tools should alert on deletion of wp-config.php or other configuration files. Check audit logs for unexpected installation routines or setup wizard initialization. Review user agent strings and source IPs in access logs; exploit attempts may originate from automated scanning tools or proxies.

Why prioritize this

This vulnerability warrants immediate prioritization due to the combination of unauthenticated access, high-impact consequences (full site takeover), and ease of exploitation. Although guest upload mode is a prerequisite, this feature is commonly enabled on community-driven or user-submission-heavy sites. The attack directly targets WordPress's core configuration, offering a fast path to administrative control. Organizations should prioritize identifying and remediating affected instances before patch availability, starting with sites that have guest uploads enabled.

Risk score, explained

The CVSS 3.1 score of 8.7 (HIGH) reflects a network-accessible vulnerability requiring no privileges or user interaction, with high impact on both integrity (attacker can delete files) and availability (site becomes non-functional). The moderate complexity factor acknowledges the requirement that guest upload mode be active, reducing the default attack surface. The scope is marked as changed because deletion of wp-config.php affects the confidentiality of database credentials and the integrity of the entire WordPress installation, extending beyond the plugin itself to the broader system.

Frequently asked questions