The vulnerability is a missing authorization flaw that allows users to interact with the Frontend File Manager beyond the intended scope. An attacker who can reach the plugin’s endpoints can read, upload, or delete files that should be protected by the site’s access control policies. The flaw enables unauthorized file access without privilege escalation from the core WordPress system itself, affecting the confidentiality and integrity of user data stored within the plugin.

N‑Media Frontend File Manager (nmedia‑user‑file‑uploader), a WordPress plugin, is affected for all versions from the initial release up to and including 23.3. The plugin is distributed by the N‑Media vendor and is installed on WordPress sites.

The CVSS base score of 5.3 indicates moderate severity, while the EPSS score of less than 1% reflects a low probability of exploitation at the time of analysis. The flaw is not listed in the CISA KEV catalog. The attack likely requires access to the WordPress site, either as a registered user or via exploitation of an existing authenticated session; the attacker may then invoke the plugin’s file management functions without proper authorization checks. The vulnerability can be leveraged to gain unauthorized access to stored files, potentially exposing sensitive data or enabling further compromise of the web application.