Security Alert Summary
The Frontend File Manager Plugin for WordPress (through version 23.5) contains functionality that allows unauthenticated users to send emails through the site without any security checks and to guess file IDs to access uploaded files. This can enable misuse of the site as an open mail relay and unauthorized exposure of uploaded files.
CVE Details
- CVE ID: CVE-2026-0829
- Affected component: Frontend File Manager Plugin WordPress plugin
- Affected versions: through 23.5
- Published: February 17, 2026 at 7:16:31 AM UTC
- Last modified: February 17, 2026 at 3:16:19 PM UTC
- CVSS v3.1: Base Score 5.8, Severity MEDIUM, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
- Authentication / Privileges / User Interaction: Authentication not required; Privileges Required: None; User Interaction: None
- Primary impact: Confidentiality: None; Integrity: Low; Availability: None
- CWE / weakness ID: Not specified in the CVE entry
Technical Details
According to the CVE entry, the plugin allows unauthenticated users to send email through the site without any security checks, meaning the plugin exposes functionality that accepts and processes email requests from unauthenticated sources. The entry also notes that an attacker can guess file IDs to access and share uploaded files without permission. These issues indicate missing or insufficient authentication and authorization checks on the plugin’s email handling and file access mechanisms, allowing the site to be used as an open relay for sending email and permitting disclosure of uploaded files.
The description does not name specific functions or REST endpoints; the conclusions above are drawn directly from the CVE description which highlights lack of security checks for outgoing email and predictable file identifiers that enable unauthorized file access.
How This Could Impact Your Website
In a typical small business WordPress site, the site owner or administrator may allow contributors or external contractors to upload files or initiate certain actions through the frontend file manager. If the plugin is vulnerable, an unauthenticated attacker could send emails using your site’s domain, increasing the risk of spam or phishing campaigns that appear to originate from your organization. At the same time, uploaded files could be accessed by guessing file IDs, potentially exposing internal documents, customer data, or other sensitive attachments to unauthorized parties.
For example, an external contractor uploads invoices and internal notes; an attacker could enumerate file IDs and retrieve those uploads, while also using the site to send phishing messages to clients or employees. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (If no fixed version is specified in the CVE entry, monitor the plugin’s official channels for updates.)
- Review and reduce unnecessary user roles and capabilities, especially for contributors and authors who can upload files.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site to reduce attack surface.
- Monitor site activity and outgoing mail logs for unusual behavior, such as unexpected spikes in email volume or downloads of uploaded files.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
