The Frontend File Manager Plugin allows a subscriber‑level authenticated user to request a file download without verifying ownership. By modifying the file_id query parameter in the download endpoint, an attacker can download any file uploaded by any user, including administrators, leading to a breach of confidentiality. This is an Insecure Direct Object Reference (IDOR) flaw. The vulnerability is thus a clear pathway for an attacker to read sensitive data stored in the application.

WordPress sites that install the Frontend File Manager Plugin, versions 23.6 and earlier. The vulnerability exists in the plugin’s download endpoint and applies to all users with Subscriber‑level access or higher.

The CVSS score is not listed, but the EPSS score is unavailable and the issue is not in CISA KEV, indicating limited public exploitation data. However, the attack requires only an authenticated user with a simple HTTP request, so the likelihood of exploitation is high in environments where the plugin is enabled and the download endpoint is exposed. The exploitation results in unauthorized read access to any file the user privileges allow, posing a significant confidentiality risk.