The Frontend File Manager Plugin allows a subscriber‑level authenticated user to request a file download without verifying ownership. By modifying the file_id query parameter in the download endpoint, an attacker can download any file uploaded by any user, including administrators, leading to a breach of confidentiality. This is an Insecure Direct Object Reference (IDOR) flaw. The vulnerability is thus a clear pathway for an attacker to read sensitive data stored in the application.

WordPress sites that install the Frontend File Manager Plugin, versions 23.6 and earlier. The vulnerability exists in the plugin’s download endpoint and applies to all users with Subscriber‑level access or higher.

The CVSS score is 6.5, and the EPSS score of 0.0002 indicates a very low but nonzero probability of exploitation. The issue is not listed in the CISA KEV catalogue. Still, the attack only requires an authenticated user with a basic HTTP request to the download endpoint, making it potentially feasible in environments where the plugin is active and the endpoint is reachable. The exploitation results in unauthorized read access to any file the user privileges allow, posing a significant confidentiality risk.