The Frontend File Manager Plugin fails to validate a nonce on its file‑metadata update action, allowing a cross‑site request forgery attack to change the metadata of an uploaded file. This flaw stems from missing CSRF protection (CWE-352) and an improper authorization mechanism. When the file is modified, an attacker can manipulate its name or location to facilitate download, effectively leaking that file to anyone who can trigger the request. The flaw also permits unauthenticated file‑metadata updates when guest uploads are enabled, enabling any visitor to download any user's file.

WordPress sites running the Frontend File Manager Plugin version 23.6 or earlier are affected. No specific sub‑versions are listed beyond the upper bound of 23.6. Upgrading to any supported release newer than 23.6 removes the issue.

The EPSS score is under 1 %, indicating a low probability of widespread exploitation, and the vulnerability is not catalogued in CISA’s KEV list. Nevertheless, the lack of CSRF protection means that a logged‑in user’s session or a public guest upload form can be abused with minimal effort. Attackers can craft a malicious link or embed an image that triggers the file‑metadata update, and no additional privileges are required beyond an authenticated user or open file‑upload access. The CVSS score is 5.4, indicating medium severity, but the potential data disclosure still makes this a significant vulnerability that should be addressed promptly.