Frontend File Manager Plugin <= 23.5 - Unauthenticated Arbitrary Email Sending
CVE-2026-0829
Verified
Description
Frontend File Manager Plugin WordPress plugin through 23.5 contains an open relay and unauthorized file access vulnerability caused by lack of authentication and security checks, letting unauthenticated attackers send emails and access files, exploit requires no authentication.
Severity
High
CVSS Score
7.5
Exploit Probability
1%
Published Date
February 24, 2026
Template Author
0x_akoko
CVE-2026-0829.yaml
7.5Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE ID:
cve-2026-0829
CWE ID:
cwe-862
References
https://www.wordfence.com/threat-intel/vulnerabilities/id/e739e7d3-756a-4c93-9ca7-f7b9f9657033https://wpscan.com/vulnerability/57d62cea-cfb8-4421-a209-e64a015ad225/https://plugins.trac.wordpress.org/browser/nmedia-user-file-uploader/tags/23.5/inc/callback-functions.php#L98https://nvd.nist.gov/vuln/detail/CVE-2026-0829
Remediation Steps
Update to the latest version beyond 23.5.