Technical impact
The Frontend File Manager Plugin for WordPress lacks a capability check on the 'wpfm_send_file_in_email' AJAX action, allowing unauthenticated users to request file deliveries by specifying a file ID. Because the plugin assigns sequential integer IDs to uploaded files, an attacker can enumerate all files on the site and transfer any that were intended to be visible only to administrators. The weakness is a missing permission check, classified as CWE-862, and the resulting impact is the disclosure and potential exfiltration of sensitive data.
Affected Systems
All installations of the Frontend File Manager Plugin by nmedia running WordPress, from the earliest release through version 23.5, are affected. This includes every site that has not upgraded beyond 23.5.
Risk and Exploitability
The vulnerability carries a CVSS score of 7.5, indicating high severity, but the EPSS score is less than 1% and it is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not yet been observed. The attack requires only an unauthenticated HTTP request to the AJAX endpoint with a crafted 'file_id' parameter, making exploitation trivial for anyone who can send requests to the site. Once a file ID is known, the attacker can retrieve the file via email without further authentication, making the potential for data leakage significant, especially for confidential documents uploaded by administrators.
