The Frontend File Manager Plugin for WordPress permits unauthenticated file deletion on its server when guest upload mode is enabled. The flaw exists because the plugin fails to validate a file path that is derived from user input before performing a delete operation. This path traversal weakness allows the attacker to store a crafted path in the plugin’s file metadata that points to arbitrary targets such as wp-config.php, causing the site to lose critical configuration and triggering the WordPress setup routine—thereby enabling a full site takeover.

Any WordPress site that has the Frontend File Manager Plugin installed at version 23.6 or older is affected, regardless of theme or other plugins. The vulnerability is confined to the file deletion logic of the compromised plugin.

The CVSS score of 8.7 indicates high severity, but the EPSS score of less than 1 % suggests that widespread exploitation is currently unlikely. The flaw is not listed in the CISA KE, because the vulnerability allows unauthenticated deletion of arbitrary files, an attacker could immediately destroy essential files and gain full control of the site. The likely attack vector is via the guest upload interface, where a crafted metadata path is supplied by the attacker; the lack of authentication and directory traversal permit targeting any file on the server.