The vulnerability is an Insecure Direct Object Reference that allows a user to supply a key identifying a file on the server. Because the plugin trusts this key without verifying the user’s role or allowed permissions, an attacker can read or modify any file the plugin manages, bypassing normal access controls. This is a classic example of the CWE‑639 weakness where authorization is improperly enforced.

WordPress sites using the N‑Media Frontend File Manager plugin version 23.5 or earlier are affected. The issue applies to all releases up to and including 23.5 regardless of the specific patch level.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog, and the attack vector is inferred to be remote via web requests that include a crafted key parameter in the plugin’s file handling URLs.