CVE-2026-8095: Frontend File Manager WordPress Plugin Arbitrary File Deletion Vulnerability

Technical summary

The vulnerability stems from a case-sensitive validation bypass in the wpfm_file_meta_update AJAX handler. The plugin attempts to block the wpfm_dir_path parameter through an unset check, but this filter can be bypassed by submitting WPFM_DIR_PATH in uppercase. WordPress's sanitize_key() function normalizes uppercase keys to lowercase during post metadata updates, allowing the uppercase variant to pass validation and be stored as wpfm_dir_path. When the delete_file_locally() function executes, it retrieves this attacker-controlled path and passes it directly to unlink() without validating that the target path remains within an intended directory boundary. This allows arbitrary filesystem deletion with the permissions of the web server process.

Business impact

A successful attack allows disruption of service through deletion of core WordPress files, data loss, and potential complete compromise of the website. An attacker could delete wp-config.php to sever database connectivity, remove wp-admin files to disable the control panel, or target plugin and theme files to destroy functionality. Given the low barrier to entry (subscriber-level credentials are common in organizations using WordPress as a collaborative platform), this represents significant operational risk even in environments that restrict administrator access. Compromised sites may require full restoration from backups.

Affected systems

WordPress installations using the Frontend File Manager Plugin in versions 23.6 and earlier are affected. Any site allowing subscriber-level user registration or accounts is at heightened risk, as this is the minimum privilege required to exploit the flaw. The vulnerability applies regardless of server OS, as WordPress runs cross-platform.

Exploitability

The vulnerability requires authentication (subscriber-level access or higher), but does not require user interaction or complex manipulation. The AJAX endpoint is accessible to any logged-in user, and the case-sensitive bypass is trivial to execute once understood. No special tools or knowledge beyond basic HTTP requests is necessary. The path traversal and lack of directory containment checks make the attack highly reliable. Exploitability is high relative to the authentication gate.

Remediation

Patch to the latest version of the Frontend File Manager Plugin when the vendor releases a corrected version. Temporary mitigations include restricting subscriber access on sites that do not require it, enforcing strict file permissions on the server (though this does not eliminate the vulnerability), and disabling the plugin if it is not actively used. Verify applied patches against the vendor advisory to confirm that both the case-sensitivity bypass and the missing path validation have been addressed.

Patch guidance

Apply the latest version of the Frontend File Manager Plugin released after the vulnerability publication date. Verify against the vendor's official changelog and security advisory that the patch addresses the case-sensitive parameter bypass and implements proper directory containment validation for file deletion operations. Test thoroughly in a staging environment before production deployment, as the plugin directly impacts file system operations.

Detection guidance

Monitor web server logs for POST requests to wp-admin/admin-ajax.php with action=wpfm_file_meta_update, particularly those containing WPFM_DIR_PATH (uppercase) parameters. Examine post metadata on affected WordPress sites for unexpected wpfm_dir_path entries that point outside the expected plugin directory. Review file system audit logs for unexpected unlink() or file deletion events originating from the web server process, especially affecting wp-config.php or other sensitive WordPress files. Compare file modification times and integrity of core WordPress files against known-good backups.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score (8.1), the critical nature of files that can be targeted (wp-config.php leads to full site takeover), and the low privilege barrier to exploitation. Unlike vulnerabilities requiring admin access, this affects any environment where subscriber accounts exist, which is common in multi-user WordPress deployments. The reliable, deterministic nature of the exploit (no user interaction required, straightforward parameter manipulation) and the lack of exploitation complexity elevate practical risk.

Risk score, explained

CVSS 8.1 (HIGH) reflects a network-accessible vulnerability requiring only low-level authentication, with no user interaction necessary, delivering high impact to integrity and availability. The attack vector is local from a network perspective, the attack complexity is low, and the scope is unchanged. The vulnerability grants an attacker the ability to delete arbitrary files, effectively causing full site takeover through deletion of wp-config.php or equivalent. The integrity impact (ability to delete critical files) and availability impact (site outage) are both rated high. The confidentiality impact is none, as the attacker is not reading files, only removing them.

Frequently asked questions