The Frontend File Manager Plugin for WordPress fails to validate a file path derived from user input before performing a delete operation. This flaw allows an unauthenticated attacker to store a crafted path in the plugin’s file metadata that points to any file on the server, including critical configuration files such as wp-config.php. Removing wp-config.php triggers the WordPress setup routine and can give the attacker full control of the site. The weakness results in a high‑severity vulnerability that can lead to a complete site takeover.

Any WordPress site that has the Frontend File Manager Plugin installed at version 23.6 or older is affected; the vulnerability exists regardless of the theme or other plugins in use. The flaw is confined to the plugin’s file deletion logic and only becomes exploitable when guest upload mode is enabled.

The CVSS score of 8.7 indicates high severity, yet the EPSS score of less than 1 % suggests that exploitation of this flaw is currently unlikely to be widespread. The vulnerability is not listed in the CISA KEV catalog. The typical attack vector is through the guest upload interface, where an attacker supplies a malicious metadata path that, due to the lack of authentication and path validation, can delete any file on the server.