CVE-2026-16292
Received Received - Intake

Frontend File Manager Plugin WordPress CSRF File Metadata Update

Publication date: 2026-08-02

Last updated on: 2026-08-02

Assigner: WPScan

Description
The Frontend File Manager Plugin WordPress plugin through 23.6 does not perform nonce validation on one of its file-metadata update actions, allowing an attacker to modify the metadata of a logged-in user's uploaded file via a CSRF attack, which can be leveraged to download that file. When guest uploads are enabled, the same action is reachable unauthenticated against any user's file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-02
Last Modified
2026-08-02
Generated
2026-08-02
AI Q&A
2026-08-02
EPSS Evaluated
N/A
NVD
CVE-2026-16292
EUVD
EUVD-2026-51947

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
frontend_file_manager plugin to 23.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Frontend File Manager WordPress plugin. It lacks nonce validation on a file-metadata update action, allowing attackers to modify file metadata via a CSRF attack. This can lead to unauthorized file downloads by logged-in users. If guest uploads are enabled, the same issue allows unauthenticated access to modify any user's file metadata.

Detection Guidance

To detect this vulnerability, check if the Frontend File Manager Plugin for WordPress is installed and its version is 23.6 or below. Look for unauthorized file metadata changes or unexpected file downloads. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to change file metadata, potentially enabling them to download sensitive files uploaded by users. If guest uploads are enabled, any user's files could be targeted without authentication, risking data exposure or unauthorized access.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive data, violating GDPR's data protection principles or HIPAA's requirements for safeguarding protected health information. Non-compliance may result in legal penalties or reputational damage.

Mitigation Strategies

Update the Frontend File Manager WordPress plugin to the latest version to ensure nonce validation is properly implemented. Disable guest uploads if enabled to prevent unauthenticated access to file metadata updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16292. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart