The Frontend File Manager Plugin for WordPress versions up to 23.5 contains a missing‑authorization flaw that permits anyone on the internet to invoke the plugin’s email sending function without authentication. As a result the site can be used as an open relay for spam or phishing messages, exposing the server to abuse. In addition, the same lack of access controls allows unauthenticated users to guess file identifiers and download uploaded files that were intended to be private, potentially leaking sensitive data. This weakness is classified as CWE‑862.

WordPress installations that have the Frontend File Manager Plugin 23.5 or older are impacted. The vendor is listed as Unknown:Frontend File Manager Plugin; no further sub‑versions are defined, so any deployment of the plugin before the 23.6 release should be considered vulnerable until it is updated.

The CVSS score of 5.8 places this vulnerability in the medium‑severity range, while the EPSS score of less than 1 % indicates a low probability of exploitation at the time of this analysis. The vulnerability is not recorded in the CISA KEV catalog. Attackers are likely to target the flaw by sending crafted HTTP requests to the plugin’s email endpoint from the public internet; no credentials or complex reconnaissance are required to abuse the open‑relay and file‑access functions.