The Frontend File Manager Plugin for WordPress does not enforce its nonce verification on the file download handler, allowing attackers without authentication to download any file uploaded by any user by iterating through file identifiers. This flaw exposes confidential user data and can lead to the disclosure of arbitrary files, potentially including sensitive documents or credentials stored by site users. The breach is confined to confidentiality; integrity and availability are not directly affected.

WordPress sites running the Frontend File Manager Plugin up to version 23.6 are affected. The vendor is unknown, but the plugin name is Frontend File Manager Plugin and any WordPress installation that has not upgraded past 23.6 is at risk.

The vulnerability is exploitable by sending unauthenticated HTTP requests to the download endpoint and guessing numeric or sequential IDs. No CVSS score is published, and an EPSS score is not available, so the exploit probability cannot be quantified from the data, but the attack is straightforward and requires no special privileges. The flaw is not listed in CISA’s KEV catalogue, indicating no publicly known widespread exploitation as of now.